Network Working Group J. Ross
Request for Comments: 3125 Security & Standards
Category: Experimental D. Pinkas
Integris
N. Pope
Security & Standards
September 2001
Network Working Group J. Ross
Request for Comments: 3125 Security & Standards
Category: Experimental D. Pinkas
Integris
N. Pope
Security & Standards
September 2001
Electronic Signature Policies
电子签名政策
Status of this Memo
本备忘录的状况
This memo defines an Experimental Protocol for the Internet community. It does not specify an Internet standard of any kind. Discussion and suggestions for improvement are requested. Distribution of this memo is unlimited.
这份备忘录为互联网社区定义了一个实验性协议。它没有规定任何类型的互联网标准。要求进行讨论并提出改进建议。本备忘录的分发不受限制。
Copyright Notice
版权公告
Copyright (C) The Internet Society (2001). All Rights Reserved.
版权所有（C）互联网协会（2001年）。版权所有。
Abstract
摘要
This document defines signature policies for electronic signatures. A signature policy is a set of rules for the creation and validation of an electronic signature, under which the validity of signature can be determined. A given legal/contractual context may recognize a particular signature policy as meeting its requirements.
本文件定义了电子签名的签名策略。签名策略是一套用于创建和验证电子签名的规则，根据这些规则可以确定签名的有效性。给定的法律/合同上下文可能会认为特定的签名策略满足其要求。
A signature policy has a globally unique reference, which is bound to an electronic signature by the signer as part of the signature calculation.
签名策略具有全局唯一引用，作为签名计算的一部分，该引用由签名者绑定到电子签名。
The signature policy needs to be available in human readable form so that it can be assessed to meet the requirements of the legal and contractual context in which it is being applied.
签名政策需要以可读的形式提供，以便能够对其进行评估，以满足适用该政策的法律和合同环境的要求。
To allow for the automatic processing of an electronic signature another part of the signature policy specifies the electronic rules for the creation and validation of the electronic signature in a computer processable form. In the current document the format of the signature policy is defined using ASN.1.
为了允许自动处理电子签名，签名政策的另一部分规定了以计算机可处理形式创建和验证电子签名的电子规则。在当前文档中，签名策略的格式是使用ASN.1定义的。
The contents of this document is based on the signature policy defined in ETSI TS 101 733 V.1.2.2 (2000-12) Copyright (C). Individual copies of this ETSI deliverable can be downloaded from http://www.etsi.org.
本文件的内容基于ETSI TS 101 733 V.1.2.2（2000-12）版权（C）中定义的签名政策。本ETSI交付成果的单独副本可从以下网站下载：http://www.etsi.org.
Table of Contents
目录
1. Introduction 3 2. Major Parties 3 3. Signature Policy Specification 5 3.1 Overall ASN.1 Structure 5 3.2 Signature Validation Policy 6 3.3 Common Rules 7 3.4 Commitment Rules 8 3.5 Signer and Verifier Rules 9 3.5.1 Signer Rules 9 3.5.2 Verifier Rules 11 3.6 Certificate and Revocation Requirements 11 3.6.1 Certificate Requirements 11 3.6.2 Revocation Requirements 13 3.7 Signing Certificate Trust Conditions 14 3.8 Time-Stamp Trust Conditions 15 3.9 Attribute Trust Conditions 16 3.10 Algorithm Constraints 17 3.11 Signature Policy Extensions 18 4. Security Considerations 18 4.1 Protection of Private Key 18 4.2 Choice of Algorithms 18 5. Conformance Requirements 19 6. References 19 7. Authors' Addresses 20 Annex A (normative): 21 A.1 Definitions Using X.208 (1988) ASN.1 Syntax 21 A.2 Definitions Using X.680 (1997) ASN.1 Syntax 27 Annex B (informative): 34 B.1 Signature Policy and Signature Validation Policy 34 B.2 Identification of Signature Policy 36 B.3 General Signature Policy Information 36 B.4 Recognized Commitment Types 37 B.5 Rules for Use of Certification Authorities 37 B.5.1 Trust Points 38 B.5.2 Certification Path 38 B.6 Revocation Rules 39 B.7 Rules for the Use of Roles 39 B.7.1 Attribute Values 39 B.7.2 Trust Points for Certified Attributes 40 B.7.3 Certification Path for Certified Attributes 40 B.8 Rules for the Use of Time-Stamping and Timing 40 B.8.1 Trust Points and Certificate Paths 41 B.8.2 Time-Stamping Authority Names 41 B.8.3 Timing Constraints - Caution Period 41 B.8.4 Timing Constraints - Time-Stamp Delay 41 B.9 Rules for Verification Data to be followed 41
1. 导言3 2。主要政党3 3。签名策略规范5 3.1总体ASN.1结构5 3.2签名验证策略6 3.3通用规则7 3.4承诺规则8 3.5签名者和验证者规则9 3.5.1签名者规则9 3.5.2验证者规则11 3.6证书和撤销要求11 3.6.1证书要求11 3.6.2撤销要求13 3.7签名证书信任条件14 3.8时间戳信任条件15 3.9属性信任条件16 3.10算法约束17 3.11签名策略扩展18 4。安全考虑18 4.1私钥保护18 4.2算法选择18 5。合规性要求19 6。参考文献19 7。作者地址20附录A（规范性）：21 A.1使用X.208（1988）ASN.1语法的定义21 A.2使用X.680（1997）ASN.1语法的定义27附录B（资料性）：34 B.1签名策略和签名验证策略34 B.2签名策略的标识36 B.3一般签名策略信息36 B.4认可的承诺类型37 B.5证书颁发机构的使用规则37 B.5.1信任点38 B.5.2证书路径38 B.6撤销规则39 B.7角色的使用规则39 B.7.1属性值39 B.7.2认证属性的信任点40 B.7.3认证属性的认证路径40 B.8时间戳和定时的使用规则40 B.8.1信任点和证书路径41 B.8.2时间戳机构名称41 B.8.3定时约束-警告期41 B.8.4定时约束-时间戳延迟41B.9应遵循的验证数据规则41
B.10 Rules for Algorithm Constraints and Key Lengths 42 B.11 Other Signature Policy Rules 42 B.12 Signature Policy Protection 42 Full Copyright Statement 44
B.10算法约束和密钥长度规则42 B.11其他签名策略规则42 B.12签名策略保护42完整版权声明44
This document is intended to cover signature policies which can be used with electronic signatures for various types of transactions, including business transactions (e.g., purchase requisition, contract, and invoice applications). Electronic signatures can be used for any transaction between an individual and a company, between two companies, between an individual and a governmental body, etc. This document is independent of any environment. It can be applied to any environment e.g., smart cards, GSM SIM cards, special programs for electronic signatures etc.
本文件旨在涵盖签名政策，该政策可与各类交易的电子签名一起使用，包括业务交易（例如，请购单、合同和发票应用）。电子签名可用于个人与公司、两家公司、个人与政府机构等之间的任何交易。本文件独立于任何环境。它可以应用于任何环境，例如智能卡、GSM SIM卡、用于电子签名的特殊程序等。
The key words "MUST", "MUST NOT", "REQUIRED", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document (in uppercase, as shown) are to be interpreted as described in [RFC2119].
本文件中的关键词“必须”、“不得”、“必需”、“应该”、“不应该”、“建议”、“可以”和“可选”（大写，如图所示）应按照[RFC2119]中所述进行解释。
The document uses the following terms:
本文件使用以下术语：
* the Signature Policy Issuer; * the Signer; * the Verifier; * the Arbitrator; * Trusted Service Providers (TSP);
* 签名策略颁发者；*签字人；*验证者；*仲裁员；*可信服务提供商（TSP）；
The Signature Policy Issuer (which is a Trusted Service Provider (TSP)) issues signatures policies that define the technical and procedural requirements for electronic signature creation, and validation/ verification, in order to meet a particular business need.
签名策略颁发者（是可信服务提供商（TSP））发布签名策略，定义电子签名创建和验证/验证的技术和程序要求，以满足特定业务需求。
The Signer is the entity that creates the electronic signature. When the signer digitally signs over an signature policy identifier, it represents a commitment on behalf of the signing entity that the data being signed is signed under the rules defined by the signature policy.
签名人是创建电子签名的实体。当签名者对签名策略标识符进行数字签名时，它代表签名实体的承诺，即正在签名的数据是根据签名策略定义的规则签名的。
The Verifier is the entity that validates the electronic signature, it may be a single entity or multiple entities. The verifier MUST validate the electronic signature under the rules defined by the electronic signature policy for the signature to be valid.
验证者是验证电子签名的实体，它可以是单个实体或多个实体。验证人必须根据电子签名政策规定的规则验证电子签名，以使签名有效。
An arbitrator, is an entity which arbitrates disputes between a signer and a verifier. It acts as verifier when it verifies the electronic signature after it has been previously validated.
仲裁员是仲裁签字人和验证者之间争议的实体。它在电子签名经过先前的验证后进行验证时充当验证者。
The Trusted Service Providers (TSPs) are one or more entities that help to build trust relationships between the signer and verifier. Use of TSP specific services MAY be mandated by signature policy. TSP supporting services include: user certificates, cross-certificates, time-stamping tokens,CRLs, ARLs, OCSP responses.
可信服务提供者（TSP）是一个或多个实体，有助于在签名者和验证者之间建立信任关系。签名策略可能强制使用TSP特定服务。TSP支持服务包括：用户证书、交叉证书、时间戳令牌、CRL、ARL、OCSP响应。
A Trusted Service Providers (TSPs) MAY be a Signature Policy Issuer, as Such, the TSP MUST define the technical and procedural requirements for electronic signature creation and validation, in order to meet a particular business need.
可信服务提供商（TSP）可能是签名策略颁发者，因此，TSP必须定义电子签名创建和验证的技术和程序要求，以满足特定的业务需求。
The following other TSPs are used to support the functions defined in this document:
以下其他TSP用于支持本文件中定义的功能：
* Certification Authorities; * Registration Authorities; * Repository Authorities (e.g., a Directory); * Time-Stamping Authorities; * One-line Certificate Status Protocol responders; * Attribute Authorities.
* 核证机关；*登记机关；*存储库权限（例如目录）；*加盖时间戳的当局；*单行证书状态协议响应程序；*属性权限。
Certification Authorities provide users with public key certificates.
证书颁发机构向用户提供公钥证书。
Registration Authorities allows the registration of entities before a CA generates certificates.
注册机构允许在CA生成证书之前注册实体。
Repository Authorities publish CRLs issued by CAs, , cross-certificates (i.e., CA certificates) issued by CAs, signature policies issued by Signature Policy Issuers and optionally public key certificates (i.e., leaf certificates) issued by CAs.
存储库管理机构发布CAs发布的CRL、CAs发布的交叉证书（即CA证书）、签名策略发布者发布的签名策略以及CAs发布的可选公钥证书（即叶证书）。
Time-Stamping Authorities attest that some data was formed before a given trusted time.
时间戳权威机构证明，某些数据是在给定的可信时间之前形成的。
One-line Certificate Status Protocol responders (OSCP responders) provide information about the status (i.e., revoked, not revoked, unknown) of a particular certificate.
单行证书状态协议响应程序（OSCP响应程序）提供特定证书的状态信息（即已撤销、未撤销、未知）。
Attributes Authorities provide users with attributes linked to public key certificates
属性授权为用户提供链接到公钥证书的属性
An Arbitrator is an entity that arbitrates disputes between a signer and a verifier.
仲裁员是仲裁签字人和验证者之间争议的实体。
A signature policy specification includes general information about the policy, the validation policy rules and other signature policy information.
签名策略规范包括有关策略的一般信息、验证策略规则和其他签名策略信息。
This document mandates that:
本文件规定：
* an electronic signature must be processed by the signer and verifier in accordance with the signature policy referenced by the signer; * the signature policy referenced by the signer must be identifiable by an Object Identifier; * there must exist a specification of the signature policy; * for a given signature policy there must be one definitive form of the specification which has a unique binary encoding; * a hash of the definitive specification, using an agreed algorithm, must be provided by the signer and checked by the verifier.
* 电子签名必须由签名人和验证人根据签名人引用的签名策略进行处理；*签名者引用的签名策略必须由对象标识符标识；*必须存在签名策略的规范；*对于给定的签名策略，必须有一种具有唯一二进制编码的明确形式的规范；*使用约定算法的最终规范散列必须由签名者提供并由验证者检查。
This document defines but does not mandate the form of the signature policy specification. The signature policy may be specified either:
本文件定义但不强制要求签名策略规范的形式。签名策略可以指定为：
* in a free form document for human interpretation; or * in a structured form using an agreed syntax and encoding.
* 在一份自由形式的文件中，供人解释；或*采用约定语法和编码的结构化形式。
This document defines an ASN.1 based syntax that may be used to define a structured signature policy. Future versions of this document may include structured a signature policy specification using XML.
本文档定义了基于ASN.1的语法，可用于定义结构化签名策略。本文档的未来版本可能包括使用XML的结构化签名策略规范。
The overall structure of a signature policy defined using ASN.1 is given in this section. Use of this ASN.1 structure is optional.
本节给出了使用ASN.1定义的签名策略的总体结构。此ASN.1结构的使用是可选的。
This ASN.1 syntax is encoded using the Distinguished Encoding Rules (DER).
此ASN.1语法使用可分辨编码规则（DER）进行编码。
In this structure the policy information is preceded by an identifier for the hashing algorithm used to protect the signature policy and followed by the hash value which must be re-calculated and checked whenever the signature policy is passed between the issuer and signer/verifier.
在此结构中，策略信息的前面是用于保护签名策略的哈希算法的标识符，后面是哈希值，每当在颁发者和签名者/验证者之间传递签名策略时，必须重新计算和检查哈希值。
The hash is calculated without the outer type and length fields.
计算哈希时不使用外部类型和长度字段。
SignaturePolicy ::= SEQUENCE {
signPolicyHashAlg AlgorithmIdentifier,
signPolicyInfo SignPolicyInfo,
signPolicyHash SignPolicyHash OPTIONAL }
SignaturePolicy ::= SEQUENCE {
signPolicyHashAlg AlgorithmIdentifier,
signPolicyInfo SignPolicyInfo,
signPolicyHash SignPolicyHash OPTIONAL }
SignPolicyHash ::= OCTET STRING
SignPolicyHash ::= OCTET STRING
SignPolicyInfo ::= SEQUENCE {
signPolicyIdentifier SignPolicyId,
dateOfIssue GeneralizedTime,
policyIssuerName PolicyIssuerName,
fieldOfApplication FieldOfApplication,
signatureValidationPolicy SignatureValidationPolicy,
signPolExtensions SignPolExtensions
OPTIONAL
}
SignPolicyInfo ::= SEQUENCE {
signPolicyIdentifier SignPolicyId,
dateOfIssue GeneralizedTime,
policyIssuerName PolicyIssuerName,
fieldOfApplication FieldOfApplication,
signatureValidationPolicy SignatureValidationPolicy,
signPolExtensions SignPolExtensions
OPTIONAL
}
SignPolicyId ::= OBJECT IDENTIFIER
SignPolicyId ::= OBJECT IDENTIFIER
PolicyIssuerName ::= GeneralNames
PolicyIssuerName ::= GeneralNames
FieldOfApplication ::= DirectoryString
FieldOfApplication ::= DirectoryString
The policyIssuerName field identifies the policy issuer in one or more of the general name forms.
policyIssuerName字段以一种或多种通用名称形式标识保单发行人。
The fieldofApplication is a description of the expected application of this policy.
应用领域是对本政策预期应用的描述。
The signature validation policy rules are fully processable to allow the validation of electronic signatures issued under that form of signature policy. They are described in the rest of this section.
签名验证策略规则是完全可处理的，允许验证根据该形式的签名策略发布的电子签名。本节其余部分将对其进行描述。
The signPolExtensions is a generic way to extend the definition of any sub-component of a signature policy.
signPolExtensions是扩展签名策略任何子组件定义的通用方法。
The signature validation policy defines for the signer which data elements must be present in the electronic signature he provides and for the verifier which data elements must be present under that signature policy for an electronic signature to be potentially valid.
签名验证策略为签名人定义了其提供的电子签名中必须存在的数据元素，并为验证者定义了该签名策略下必须存在的数据元素，以使电子签名具有潜在有效性。
The signature validation policy is described as follows:
签名验证策略描述如下：
SignatureValidationPolicy ::= SEQUENCE {
signingPeriod SigningPeriod,
commonRules CommonRules,
commitmentRules CommitmentRules,
signPolExtensions SignPolExtensions OPTIONAL
}
SignatureValidationPolicy ::= SEQUENCE {
signingPeriod SigningPeriod,
commonRules CommonRules,
commitmentRules CommitmentRules,
signPolExtensions SignPolExtensions OPTIONAL
}
The signingPeriod identifies the date and time before which the signature policy SHOULD NOT be used for creating signatures, and an optional date after which it should not be used for creating signatures.
signingPeriod标识签名策略不应用于创建签名的日期和时间，以及不应用于创建签名的可选日期。
SigningPeriod ::= SEQUENCE {
notBefore GeneralizedTime,
notAfter GeneralizedTime OPTIONAL }
SigningPeriod ::= SEQUENCE {
notBefore GeneralizedTime,
notAfter GeneralizedTime OPTIONAL }
The CommonRules define rules that are common to all commitment types. These rules are defined in terms of trust conditions for certificates, time-stamps and attributes, along with any constraints on attributes that may be included in the electronic signature.
CommonRules定义所有承诺类型通用的规则。这些规则是根据证书、时间戳和属性的信任条件以及对可能包括在电子签名中的属性的任何约束来定义的。
CommonRules ::= SEQUENCE {
signerAndVeriferRules [0] SignerAndVerifierRules
OPTIONAL,
signingCertTrustCondition [1] SigningCertTrustCondition
OPTIONAL,
timeStampTrustCondition [2] TimestampTrustCondition
OPTIONAL,
attributeTrustCondition [3] AttributeTrustCondition
OPTIONAL,
algorithmConstraintSet [4] AlgorithmConstraintSet
OPTIONAL,
signPolExtensions [5] SignPolExtensions
OPTIONAL
}
CommonRules ::= SEQUENCE {
signerAndVeriferRules [0] SignerAndVerifierRules
OPTIONAL,
signingCertTrustCondition [1] SigningCertTrustCondition
OPTIONAL,
timeStampTrustCondition [2] TimestampTrustCondition
OPTIONAL,
attributeTrustCondition [3] AttributeTrustCondition
OPTIONAL,
algorithmConstraintSet [4] AlgorithmConstraintSet
OPTIONAL,
signPolExtensions [5] SignPolExtensions
OPTIONAL
}
If a field is present in CommonRules then the equivalent field must not be present in any of the CommitmentRules (see below). If any of the following fields are not present in CommonRules then it must be present in each CommitmentRule:
如果CommonRules中存在一个字段，则任何CommitmentRules中都不得存在等效字段（见下文）。如果CommonRules中不存在以下任何字段，则它必须存在于每个CommitmentRule中：
* signerAndVeriferRules; * signingCertTrustCondition; * timeStampTrustCondition.
* 标识和验证套圈；*签署CertTrustCondition；*这是一个非常好的条件。
The CommitmentRules consists of the validation rules which apply to given commitment types:
承诺规则包括适用于给定承诺类型的验证规则：
CommitmentRules ::= SEQUENCE OF CommitmentRule
CommitmentRules ::= SEQUENCE OF CommitmentRule
The CommitmentRule for given commitment types are defined in terms of trust conditions for certificates, time-stamps and attributes, along with any constraints on attributes that may be included in the electronic signature.
给定承诺类型的承诺规则根据证书、时间戳和属性的信任条件以及对可能包含在电子签名中的属性的任何约束进行定义。
CommitmentRule ::= SEQUENCE {
selCommitmentTypes SelectedCommitmentTypes,
signerAndVeriferRules [0] SignerAndVerifierRules
OPTIONAL,
signingCertTrustCondition [1] SigningCertTrustCondition
OPTIONAL,
timeStampTrustCondition [2] TimestampTrustCondition
OPTIONAL,
attributeTrustCondition [3] AttributeTrustCondition
OPTIONAL,
algorithmConstraintSet [4] AlgorithmConstraintSet
OPTIONAL,
signPolExtensions [5] SignPolExtensions
OPTIONAL
}
CommitmentRule ::= SEQUENCE {
selCommitmentTypes SelectedCommitmentTypes,
signerAndVeriferRules [0] SignerAndVerifierRules
OPTIONAL,
signingCertTrustCondition [1] SigningCertTrustCondition
OPTIONAL,
timeStampTrustCondition [2] TimestampTrustCondition
OPTIONAL,
attributeTrustCondition [3] AttributeTrustCondition
OPTIONAL,
algorithmConstraintSet [4] AlgorithmConstraintSet
OPTIONAL,
signPolExtensions [5] SignPolExtensions
OPTIONAL
}
SelectedCommitmentTypes ::= SEQUENCE OF CHOICE {
empty NULL,
recognizedCommitmentType CommitmentType }
SelectedCommitmentTypes ::= SEQUENCE OF CHOICE {
empty NULL,
recognizedCommitmentType CommitmentType }
If the SelectedCommitmentTypes indicates "empty" then this rule applied when a commitment type is not present (i.e., the type of commitment is indicated in the semantics of the message). Otherwise, the electronic signature must contain a commitment type indication that must fit one of the commitments types that are mentioned in CommitmentType.
如果SelectedCommitmentTypes指示“empty”，则当承诺类型不存在时（即，承诺类型在消息的语义中指示）应用此规则。否则，电子签名必须包含承诺类型指示，该指示必须符合承诺类型中提到的承诺类型之一。
A specific commitment type identifier must not appear in more than one commitment rule.
特定的承诺类型标识符不能出现在多个承诺规则中。
CommitmentType ::= SEQUENCE {
identifier CommitmentTypeIdentifier,
fieldOfApplication [0] FieldOfApplication OPTIONAL,
semantics [1] DirectoryString OPTIONAL }
CommitmentType ::= SEQUENCE {
identifier CommitmentTypeIdentifier,
fieldOfApplication [0] FieldOfApplication OPTIONAL,
semantics [1] DirectoryString OPTIONAL }
The fieldOfApplication and semantics fields define the specific use and meaning of the commitment within the overall field of application defined for the policy.
fieldOfApplication和semantics字段定义了在为策略定义的整个应用领域内承诺的具体用途和含义。
The following rules apply to the format of electronic signatures defined using [ES-FORMATS].
下列规则适用于使用[电子签名格式]定义的电子签名格式。
The SignerAndVerifierRules consists of signer rule and verification rules as defined below:
签名者验证规则由签名者规则和验证规则组成，定义如下：
SignerAndVerifierRules ::= SEQUENCE {
signerRules SignerRules,
verifierRules VerifierRules }
SignerAndVerifierRules ::= SEQUENCE {
signerRules SignerRules,
verifierRules VerifierRules }
The signer rules identify:
签署人规则确定：
* if the eContent is empty and the signature is calculated using a hash of signed data external to CMS structure.
* 如果eContent为空，则使用CMS结构外部的签名数据哈希计算签名。
* the CMS signed attributes that must be provided by the signer under this policy;
* 根据本政策，签名者必须提供的CMS签名属性；
* the CMS unsigned attribute that must be provided by the signer under this policy;
* 此策略下签名者必须提供的CMS unsigned属性；
* whether the certificate identifiers from the full certification path up to the trust point must be provided by the signer in the SigningCertificate attribute;
* 签名者是否必须在SigningCertificate属性中提供从完整证书路径到信任点的证书标识符；
* whether a signer's certificate, or all certificates in the certification path to the trust point must be by the signer in the * certificates field of SignedData.
* 签名者的证书或指向信任点的证书路径中的所有证书必须由签名者在SignedData的*certificates字段中指定。
SignerRules ::= SEQUENCE {
externalSignedData BOOLEAN OPTIONAL,
-- True if signed data is external to CMS structure
-- False if signed data part of CMS structure
-- Not present if either allowed
mandatedSignedAttr CMSAttrs,
-- Mandated CMS signed attributes
mandatedUnsignedAttr CMSAttrs,
-- Mandated CMS unsigned attributed
mandatedCertificateRef [0] CertRefReq DEFAULT signerOnly,
-- Mandated Certificate Reference
SignerRules ::= SEQUENCE {
externalSignedData BOOLEAN OPTIONAL,
-- True if signed data is external to CMS structure
-- False if signed data part of CMS structure
-- Not present if either allowed
mandatedSignedAttr CMSAttrs,
-- Mandated CMS signed attributes
mandatedUnsignedAttr CMSAttrs,
-- Mandated CMS unsigned attributed
mandatedCertificateRef [0] CertRefReq DEFAULT signerOnly,
-- Mandated Certificate Reference
mandatedCertificateInfo [1] CertInfoReq DEFAULT none, -- Mandated Certificate Info signPolExtensions [2] SignPolExtensions OPTIONAL }
mandatedCertificateInfo[1]CertInfo默认无，--强制证书信息signPolExtensions[2]signPolExtensions可选}
CMSattrs ::= SEQUENCE OF OBJECT IDENTIFIER
CMSattrs ::= SEQUENCE OF OBJECT IDENTIFIER
The mandated SignedAttr field must include the object identifier for all those signed attributes required by this document as well as additional attributes required by this policy.
强制SignedAttr字段必须包含此文档所需的所有已签名属性的对象标识符以及此策略所需的其他属性。
The mandatedUnsignedAttr field must include the object identifier for all those unsigned attributes required by this document as well as additional attributes required by this policy. For example, if a signature time-stamp <see section 1.1) is required by the signer the object identifier for this attribute must be included.
mandatedUnsignedAttr字段必须包含此文档所需的所有未签名属性的对象标识符以及此策略所需的其他属性。例如，如果签名者需要签名时间戳（见第1.1节），则必须包括该属性的对象标识符。
The mandatedCertificateRef identifies whether just the signer's certificate, or all the full certificate path must be provided by the signer.
mandatedCertificateRef标识签名者必须提供的是签名者的证书，还是所有完整的证书路径。
CertRefReq ::= ENUMERATED {
signerOnly (1),
-- Only reference to signer cert mandated
fullpath (2)
CertRefReq ::= ENUMERATED {
signerOnly (1),
-- Only reference to signer cert mandated
fullpath (2)
-- References for full cert path up to a trust point required }
--需要到信任点的完整证书路径的引用}
The mandatedCertificateInfo field identifies whether a signer's certificate, or all certificates in the certification path to the trust point must be provided by the signer in the certificates field of SignedData.
mandatedCertificateInfo字段标识签名者的证书或指向信任点的证书路径中的所有证书必须由签名者在SignedData的证书字段中提供。
CertInfoReq ::= ENUMERATED {
none (0) ,
-- No mandatory requirements
signerOnly (1) ,
-- Only reference to signer cert mandated
fullpath (2)
-- References for full cert path up to a
-- trust point mandated
}
CertInfoReq ::= ENUMERATED {
none (0) ,
-- No mandatory requirements
signerOnly (1) ,
-- Only reference to signer cert mandated
fullpath (2)
-- References for full cert path up to a
-- trust point mandated
}
The verifier rules identify:
验证者规则确定：
* The CMS unsigned attributes that must be present under this policy and must be added by the verifier if not added by the signer.
* CMS unsigned attributes必须在此策略下出现，如果不是由签名者添加，则必须由验证者添加。
VerifierRules ::= SEQUENCE {
mandatedUnsignedAttr MandatedUnsignedAttr,
signPolExtensions SignPolExtensions OPTIONAL
}
VerifierRules ::= SEQUENCE {
mandatedUnsignedAttr MandatedUnsignedAttr,
signPolExtensions SignPolExtensions OPTIONAL
}
MandatedUnsignedAttr ::= CMSAttrs
-- Mandated CMS unsigned attributed
MandatedUnsignedAttr ::= CMSAttrs
-- Mandated CMS unsigned attributed
The SigningCertTrustCondition, TimestampTrustCondition and AttributeTrustCondition (defined in subsequent sub-sections) make use of two ASN1 structures which are defined below: CertificateTrustTrees and CertRevReq.
SigningCertTrustCondition、TimestampTrustCondition和AttributeTrustCondition（在后面的小节中定义）使用两个ASN1结构，它们定义如下：CertificateTrustTrees和CertRevReq。
The certificateTrustTrees identifies a set of self signed certificates for the trust points used to start (or end) certificate path processing and the initial conditions for certificate path validation as defined RFC 2459 [7] section 4. This ASN1 structure is used to define policy for validating the signing certificate, the TSA's certificate and attribute certificates.
certificateTrustTrees为用于启动（或结束）证书路径处理的信任点以及RFC 2459[7]第4节定义的证书路径验证初始条件标识一组自签名证书。此ASN1结构用于定义验证签名证书、TSA证书和属性证书的策略。
CertificateTrustTrees ::= SEQUENCE OF CertificateTrustPoint
CertificateTrustTrees ::= SEQUENCE OF CertificateTrustPoint
CertificateTrustPoint ::= SEQUENCE {
trustpoint Certificate,
-- self-signed certificate
pathLenConstraint [0] PathLenConstraint OPTIONAL,
acceptablePolicySet [1] AcceptablePolicySet OPTIONAL,
-- If not present "any policy"
nameConstraints [2] NameConstraints OPTIONAL,
policyConstraints [3] PolicyConstraints OPTIONAL }
CertificateTrustPoint ::= SEQUENCE {
trustpoint Certificate,
-- self-signed certificate
pathLenConstraint [0] PathLenConstraint OPTIONAL,
acceptablePolicySet [1] AcceptablePolicySet OPTIONAL,
-- If not present "any policy"
nameConstraints [2] NameConstraints OPTIONAL,
policyConstraints [3] PolicyConstraints OPTIONAL }
The trustPoint field gives the self signed certificate for the CA that is used as the trust point for the start of certificate path processing.
trustPoint字段提供CA的自签名证书，该证书用作开始证书路径处理的信任点。
The pathLenConstraint field gives the maximum number of CA certificates that may be in a certification path following the trustpoint. A value of zero indicates that only the given trustpoint certificate and an end-entity certificate may be used. If present, the pathLenConstraint field must be greater than or equal to zero. Where pathLenConstraint is not present, there is no limit to the allowed length of the certification path.
pathLenConstraint字段提供信任点之后的证书路径中可能存在的CA证书的最大数量。值为零表示只能使用给定的信任点证书和最终实体证书。如果存在，pathLenConstraint字段必须大于或等于零。如果不存在pathLenConstraint，则证书路径的允许长度没有限制。
PathLenConstraint ::= INTEGER (0..MAX)
PathLenConstraint ::= INTEGER (0..MAX)
The acceptablePolicySet field identifies the initial set of
certificate policies, any of which are acceptable under the signature
policy. AcceptablePolicySet ::= SEQUENCE OF CertPolicyId
The acceptablePolicySet field identifies the initial set of
certificate policies, any of which are acceptable under the signature
policy. AcceptablePolicySet ::= SEQUENCE OF CertPolicyId
CertPolicyId ::= OBJECT IDENTIFIER
CertPolicyId ::= OBJECT IDENTIFIER
The nameConstraints field indicates a name space within which all subject names in subsequent certificates in a certification path must be located. Restrictions may apply to the subject distinguished name or subject alternative names. Restrictions apply only when the specified name form is present. If no name of the type is in the certificate, the certificate is acceptable.
nameConstraints字段表示一个名称空间，证书路径中后续证书中的所有使用者名称都必须位于该名称空间中。限制可能适用于受试者专有名称或受试者备选名称。仅当指定的名称表单存在时，限制才适用。如果证书中没有类型名称，则该证书是可接受的。
Restrictions are defined in terms of permitted or excluded name subtrees. Any name matching a restriction in the excludedSubtrees field is invalid regardless of information appearing in the permittedSubtrees.
限制是根据允许或排除的名称子树定义的。任何与excludedSubtrees字段中的限制匹配的名称都无效，无论permittedSubtrees中显示的信息如何。
NameConstraints ::= SEQUENCE {
permittedSubtrees [0] GeneralSubtrees OPTIONAL,
excludedSubtrees [1] GeneralSubtrees OPTIONAL }
NameConstraints ::= SEQUENCE {
permittedSubtrees [0] GeneralSubtrees OPTIONAL,
excludedSubtrees [1] GeneralSubtrees OPTIONAL }
GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
GeneralSubtree ::= SEQUENCE {
base GeneralName,
minimum [0] BaseDistance DEFAULT 0,
maximum [1] BaseDistance OPTIONAL }
GeneralSubtree ::= SEQUENCE {
base GeneralName,
minimum [0] BaseDistance DEFAULT 0,
maximum [1] BaseDistance OPTIONAL }
BaseDistance ::= INTEGER (0..MAX)
BaseDistance ::= INTEGER (0..MAX)
The policyConstraints extension constrains path processing in two ways. It can be used to prohibit policy mapping or require that each certificate in a path contain an acceptable policy identifier.
policyConstraints扩展以两种方式约束路径处理。它可用于禁止策略映射或要求路径中的每个证书包含可接受的策略标识符。
The policyConstraints field, if present specifies requirement for explicit indication of the certificate policy and/or the constraints on policy mapping.
policyConstraints字段（如果存在）指定明确指示证书策略和/或策略映射约束的要求。
PolicyConstraints ::= SEQUENCE {
requireExplicitPolicy [0] SkipCerts OPTIONAL,
inhibitPolicyMapping [1] SkipCerts OPTIONAL }
PolicyConstraints ::= SEQUENCE {
requireExplicitPolicy [0] SkipCerts OPTIONAL,
inhibitPolicyMapping [1] SkipCerts OPTIONAL }
SkipCerts ::= INTEGER (0..MAX)
SkipCerts ::= INTEGER (0..MAX)
If the inhibitPolicyMapping field is present, the value indicates the number of additional certificates that may appear in the path (including the trustpoint's self certificate) before policy mapping is no longer permitted. For example, a value of one indicates that policy mapping may be processed in certificates issued by the subject of this certificate, but not in additional certificates in the path.
如果存在inhibitPolicyMapping字段，则该值指示在不再允许策略映射之前，路径中可能出现的其他证书数（包括信任点的自证书）。例如，值为1表示可以在该证书的主体颁发的证书中处理策略映射，但不能在路径中的其他证书中处理。
If the requireExplicitPolicy field is present, subsequent certificates must include an acceptable policy identifier. The value of requireExplicitPolicy indicates the number of additional certificates that may appear in the path (including the trustpoint's self certificate) before an explicit policy is required. An acceptable policy identifier is the identifier of a policy required by the user of the certification path or the identifier of a policy which has been declared equivalent through policy mapping.
如果存在requireExplicitPolicy字段，则后续证书必须包含可接受的策略标识符。requireExplicitPolicy的值表示在需要显式策略之前，路径中可能出现的其他证书的数量（包括信任点的自我证书）。可接受的策略标识符是认证路径的用户所需的策略的标识符或通过策略映射声明为等效的策略的标识符。
The RevocRequirements field specifies minimum requirements for revocation information, obtained through CRLs and/or OCSP responses, to be used in checking the revocation status of certificates. This ASN1 structure is used to define policy for validating the signing certificate, the TSA's certificate and attribute certificates.
RevocRequirements字段指定通过CRL和/或OCSP响应获取的吊销信息的最低要求，用于检查证书的吊销状态。此ASN1结构用于定义验证签名证书、TSA证书和属性证书的策略。
CertRevReq ::= SEQUENCE {
endCertRevReq RevReq,
caCerts [0] RevReq
}
CertRevReq ::= SEQUENCE {
endCertRevReq RevReq,
caCerts [0] RevReq
}
Certificate revocation requirements are specified in terms of checks required on:
证书撤销要求在以下方面的检查中规定：
* endCertRevReq: end certificates (i.e., the signers certificate, the attribute certificate or the time-stamping authority certificate).
* endCertRevReq：结束证书（即签名者证书、属性证书或时间戳颁发机构证书）。
* caCerts: CA certificates.
* 证书：CA证书。
RevReq ::= SEQUENCE {
enuRevReq EnuRevReq,
exRevReq SignPolExtensions OPTIONAL}
RevReq ::= SEQUENCE {
enuRevReq EnuRevReq,
exRevReq SignPolExtensions OPTIONAL}
An authority certificate is certificate issued to an authority (e.g., either to a certification authority or to an attribute authority (AA)).
颁发机构证书是颁发给颁发机构的证书（例如，颁发给证书颁发机构或属性颁发机构（AA））。
A Time-Stamping Authority (TSA) is a trusted third party that creates time-stamp tokens in order to indicate that a datum existed at a particular point in time. See [TSP].
时间戳授权机构（TSA）是一个可信的第三方，它创建时间戳令牌，以指示数据存在于特定时间点。见[TSP]。
EnuRevReq ::= ENUMERATED {
clrCheck (0),
--Checks must be made against current CRLs
-- (or authority revocation lists (ARL))
ocspCheck (1), -- The revocation status must be checked
-- using the Online Certificate Status Protocol
-- (OCSP),RFC 2450.
bothCheck (2),
-- Both CRL and OCSP checks must be carried out
eitherCheck (3),
-- At least one of CRL or OCSP checks must be
-- carried out
noCheck (4),
-- no check is mandated
other (5)
-- Other mechanism as defined by signature policy
-- extension
}
EnuRevReq ::= ENUMERATED {
clrCheck (0),
--Checks must be made against current CRLs
-- (or authority revocation lists (ARL))
ocspCheck (1), -- The revocation status must be checked
-- using the Online Certificate Status Protocol
-- (OCSP),RFC 2450.
bothCheck (2),
-- Both CRL and OCSP checks must be carried out
eitherCheck (3),
-- At least one of CRL or OCSP checks must be
-- carried out
noCheck (4),
-- no check is mandated
other (5)
-- Other mechanism as defined by signature policy
-- extension
}
Revocation requirements are specified in terms of:
撤销要求规定如下：
* clrCheck: Checks must be made against current CRLs (or authority revocation lists); * ocspCheck: The revocation status must be checked using the Online Certificate Status Protocol (RFC 2450); * bothCheck: Both OCSP and CRL checks must be carried out; * eitherCheck: Either OCSP or CRL checks must be carried out; * noCheck: No check is mandated.
* clrCheck：必须根据当前CRL（或权限撤销列表）进行检查；*ocspCheck：必须使用联机证书状态协议（RFC 2450）检查吊销状态；*两项检查：必须同时进行OCSP和CRL检查；*检查：必须进行OCSP或CRL检查；*不检查：不强制检查。
The SigningCertTrustCondition field identifies trust conditions for certificate path processing used to validate the signing certificate.
SigningCertTrustCondition字段标识用于验证签名证书的证书路径处理的信任条件。
SigningCertTrustCondition ::= SEQUENCE {
signerTrustTrees CertificateTrustTrees,
signerRevReq CertRevReq
}
SigningCertTrustCondition ::= SEQUENCE {
signerTrustTrees CertificateTrustTrees,
signerRevReq CertRevReq
}
The TimeStampTrustCondition field identifies trust conditions for certificate path processing used to authenticate the timstamping authority and constraints on the name of the time-stamping authority. This applies to the time-stamp that must be present in every ES-T.
TimeStampTrustCondition字段标识用于验证timstamping颁发机构的证书路径处理的信任条件以及对时间戳颁发机构名称的约束。这适用于每个ES-T中必须存在的时间戳。
TimestampTrustCondition ::= SEQUENCE {
ttsCertificateTrustTrees [0] CertificateTrustTrees
OPTIONAL,
ttsRevReq [1] CertRevReq
OPTIONAL,
ttsNameConstraints [2] NameConstraints
OPTIONAL,
cautionPeriod [3] DeltaTime
OPTIONAL,
signatureTimestampDelay [4] DeltaTime
OPTIONAL }
TimestampTrustCondition ::= SEQUENCE {
ttsCertificateTrustTrees [0] CertificateTrustTrees
OPTIONAL,
ttsRevReq [1] CertRevReq
OPTIONAL,
ttsNameConstraints [2] NameConstraints
OPTIONAL,
cautionPeriod [3] DeltaTime
OPTIONAL,
signatureTimestampDelay [4] DeltaTime
OPTIONAL }
DeltaTime ::= SEQUENCE {
deltaSeconds INTEGER,
deltaMinutes INTEGER,
deltaHours INTEGER,
deltaDays INTEGER }
DeltaTime ::= SEQUENCE {
deltaSeconds INTEGER,
deltaMinutes INTEGER,
deltaHours INTEGER,
deltaDays INTEGER }
If ttsCertificateTrustTrees is not present then the same rule as defined in certificateTrustCondition applies to certification of the time-stamping authorities public key.
如果ttsCertificateTrustTrees不存在，则certificateTrustCondition中定义的相同规则适用于时间戳颁发机构公钥的认证。
The tstrRevReq specifies minimum requirements for revocation information, obtained through CRLs and/or OCSP responses, to be used in checking the revocation status of the time-stamp that must be present in the ES-T.
tstrRevReq规定了通过CRL和/或OCSP响应获得的撤销信息的最低要求，用于检查ES-T中必须存在的时间戳的撤销状态。
If ttsNameConstraints is not present then there are no additional naming constraints on the trusted time-stamping authority other than those implied by the ttsCertificateTrustTrees.
如果ttsNameConstraints不存在，则除了ttsCertificateTrustTrees暗示的命名约束外，受信任的时间戳颁发机构上没有其他命名约束。
The cautionPeriod field specifies a caution period after the signing time that it is mandated the verifier must wait to get high assurance of the validity of the signer's key and that any relevant revocation has been notified. The revocation status information forming the ES with Complete validation data must not be collected and used to validate the electronic signature until after this caution period.
cautionPeriod字段指定签名时间之后的一个警告期，该警告期是验证者必须等待的，以获得对签名者密钥有效性的高度保证，并且已通知任何相关撤销。在该警告期结束之前，不得收集构成具有完整验证数据的电子签名的撤销状态信息，并将其用于验证电子签名。
The signatureTimestampDelay field specifies a maximum acceptable time between the signing time and the time at which the signature time-stamp, as used to form the ES Time-Stamped, is created for the
signatureTimestampDelay字段指定签名时间与用于形成ES时间戳的签名时间戳创建时间之间的最大可接受时间
verifier. If the signature time-stamp is later that the time in the signing-time attribute by more than the value given in signatureTimestampDelay, the signature must be considered invalid.
验证者。如果签名时间戳晚于signing time属性中的时间超过signatureTimestampDelay中给定的值，则签名必须视为无效。
If the attributeTrustCondition field is not present then any certified attributes may not considered to be valid under this validation policy. The AttributeTrustCondition field is defined as follows:
如果attributeTrustCondition字段不存在，则根据此验证策略，任何经认证的属性都可能无效。AttributeTrustCondition字段定义如下：
AttributeTrustCondition ::= SEQUENCE {
attributeMandated BOOLEAN,
-- Attribute must be present
howCertAttribute HowCertAttribute,
attrCertificateTrustTrees [0] CertificateTrustTrees OPTIONAL,
attrRevReq [1] CertRevReq OPTIONAL,
attributeConstraints [2] AttributeConstraints OPTIONAL }
AttributeTrustCondition ::= SEQUENCE {
attributeMandated BOOLEAN,
-- Attribute must be present
howCertAttribute HowCertAttribute,
attrCertificateTrustTrees [0] CertificateTrustTrees OPTIONAL,
attrRevReq [1] CertRevReq OPTIONAL,
attributeConstraints [2] AttributeConstraints OPTIONAL }
If attributeMandated is true then an attribute, certified within the following constraints, must be present. If false, then the signature is still valid if no attribute is specified.
如果attributeMandated为true，则必须存在在以下约束内认证的属性。如果为false，则如果未指定属性，则签名仍然有效。
The howCertAttribute field specifies whether attributes uncertified attributes "claimed" by the signer, or certified attributes (i.e., Attribute Certificates) or either using the signer attributes attribute defined in [ES-FORMATS] section 3.12.3.
howCertAttribute字段指定是由签名者“声明”未经认证的属性，还是经认证的属性（即属性证书），或者使用[ES-FORMATS]第3.12.3节中定义的签名者属性。
HowCertAttribute ::= ENUMERATED {
claimedAttribute (0),
certifiedAttribtes (1),
either (2) }
HowCertAttribute ::= ENUMERATED {
claimedAttribute (0),
certifiedAttribtes (1),
either (2) }
The attrCertificateTrustTrees specifies certificate path conditions for any attribute certificate. If not present the same rules apply as in certificateTrustCondition.
attrCertificateTrustTrees为任何属性证书指定证书路径条件。如果不存在，则应用与certificateTrustCondition中相同的规则。
The attrRevReq specifies minimum requirements for revocation information, obtained through CRLs and/or OCSP responses, to be used in checking the revocation status of Attribute Certificates, if any are present.
attrRevReq规定了通过CRL和/或OCSP响应获得的撤销信息的最低要求，用于检查属性证书（如果存在）的撤销状态。
If the attributeConstraints field is not present then there are no constraints on the attributes that may be validated under this policy. The attributeConstraints field is defined as follows:
如果attributeConstraints字段不存在，则在此策略下可能验证的属性上没有约束。attributeConstraints字段定义如下：
AttributeConstraints ::= SEQUENCE {
attributeTypeConstarints [0] AttributeTypeConstraints
OPTIONAL,
attributeValueConstarints [1] AttributeValueConstraints
OPTIONAL }
AttributeConstraints ::= SEQUENCE {
attributeTypeConstarints [0] AttributeTypeConstraints
OPTIONAL,
attributeValueConstarints [1] AttributeValueConstraints
OPTIONAL }
If present, the attributeTypeConstarints field specifies the attribute types which are considered valid under the signature policy. Any value for that attribute is considered valid.
如果存在，attributeTypeConstarints字段将指定在签名策略下被视为有效的属性类型。该属性的任何值都被视为有效。
AttributeTypeConstraints ::= SEQUENCE OF AttributeType
AttributeTypeConstraints ::= SEQUENCE OF AttributeType
If present, the attributeTypeConstraints field specifies the specific attribute values which are considered valid under the signature policy.
如果存在，attributeTypeConstraints字段将指定在签名策略下被视为有效的特定属性值。
AttributeValueConstraints ::= SEQUENCE OF AttributeTypeAndValue
AttributeValueConstraints ::= SEQUENCE OF AttributeTypeAndValue
The algorithmConstrains fields, if present, identifies the signing algorithms (hash, public key cryptography, combined hash and public key cryptography) that may be used for specific purposes and any minimum length. If this field is not present then the policy applies no constraints.
AlgorithmConstraints字段（如果存在）标识可用于特定目的和任何最小长度的签名算法（哈希、公钥加密、组合哈希和公钥加密）。如果此字段不存在，则策略不应用任何约束。
AlgorithmConstraintSet ::= SEQUENCE { -- Algorithm constrains on:
signerAlgorithmConstraints [0] AlgorithmConstraints OPTIONAL,
-- signer
eeCertAlgorithmConstraints [1] AlgorithmConstraints OPTIONAL,
-- issuer of end entity certs.
caCertAlgorithmConstraints [2] AlgorithmConstraints OPTIONAL,
-- issuer of CA certificates
aaCertAlgorithmConstraints [3] AlgorithmConstraints OPTIONAL,
-- Attribute Authority
tsaCertAlgorithmConstraints [4] AlgorithmConstraints OPTIONAL
-- Time-Stamping Authority
}
AlgorithmConstraintSet ::= SEQUENCE { -- Algorithm constrains on:
signerAlgorithmConstraints [0] AlgorithmConstraints OPTIONAL,
-- signer
eeCertAlgorithmConstraints [1] AlgorithmConstraints OPTIONAL,
-- issuer of end entity certs.
caCertAlgorithmConstraints [2] AlgorithmConstraints OPTIONAL,
-- issuer of CA certificates
aaCertAlgorithmConstraints [3] AlgorithmConstraints OPTIONAL,
-- Attribute Authority
tsaCertAlgorithmConstraints [4] AlgorithmConstraints OPTIONAL
-- Time-Stamping Authority
}
AlgorithmConstraints ::= SEQUENCE OF AlgAndLength
AlgorithmConstraints ::= SEQUENCE OF AlgAndLength
AlgAndLength ::= SEQUENCE {
algID OBJECT IDENTIFIER,
minKeyLength INTEGER OPTIONAL,
-- Minimum key length in bits
other SignPolExtensions OPTIONAL
}
AlgAndLength ::= SEQUENCE {
algID OBJECT IDENTIFIER,
minKeyLength INTEGER OPTIONAL,
-- Minimum key length in bits
other SignPolExtensions OPTIONAL
}
An Attribute Authority (AA)is authority which assigns privileges by issuing attribute certificates
属性权限（AA）是通过颁发属性证书来分配权限的权限
Additional signature policy rules may be added to:
可以将其他签名策略规则添加到：
* the overall signature policy structure, as defined in section 3.1; * the signature validation policy structure, as defined in section 3.2; * the common rules, as defined in section 3.3; * the commitment rules, as defined in section 3.4; * the signer rules, as defined in section 3.5.1; * the verifier rules, as defined in section 3.5.2; * the revocation requirements in section 3.6.2; * the algorithm constraints in section 3.10.
* 第3.1节中定义的总体签名策略结构；*第3.2节中定义的签名验证策略结构；*第3.3节中定义的通用规则；*第3.4节中定义的承诺规则；*第3.5.1节中定义的签署人规则；*第3.5.2节中定义的验证者规则；*第3.6.2节中的撤销要求；*第3.10节中的算法约束。
These extensions to the signature policy rules must be defined using an ASN.1 syntax with an associated object identifier carried in the SignPolExtn as defined below:
签名策略规则的这些扩展必须使用ASN.1语法定义，并在SignPolExtn中携带关联的对象标识符，定义如下：
SignPolExtensions ::= SEQUENCE OF SignPolExtn
SignPolExtensions ::= SEQUENCE OF SignPolExtn
SignPolExtn ::= SEQUENCE {
extnID OBJECT IDENTIFIER,
extnValue OCTET STRING }
SignPolExtn ::= SEQUENCE {
extnID OBJECT IDENTIFIER,
extnValue OCTET STRING }
The extnID field must contain the object identifier for the extension. The extnValue field must contain the DER (see ITU-T Recommendation X.690 [4]) encoded value of the extension. The definition of an extension, as identified by extnID must include a definition of the syntax and semantics of the extension.
extnID字段必须包含扩展的对象标识符。extnValue字段必须包含扩展的DER编码值（见ITU-T建议X.690[4]）。extnID标识的扩展定义必须包括扩展的语法和语义定义。
The security of the electronic signature mechanism defined in this document depends on the privacy of the signer's private key. Implementations must take steps to ensure that private keys cannot be compromised.
本文件中定义的电子签名机制的安全性取决于签名人私钥的隐私。实现必须采取措施确保私钥不会被泄露。
Implementers should be aware that cryptographic algorithms become weaker with time. As new cryptoanalysis techniques are developed and computing performance improves, the work factor to break a particular
实现者应该意识到加密算法会随着时间的推移变得越来越弱。随着新密码分析技术的发展和计算性能的提高，破坏特定密码的工作因素
cryptographic algorithm will reduce. Therefore, cryptographic algorithm implementations should be modular allowing new algorithms to be readily inserted. That is, implementers should be prepared for the set of mandatory to implement algorithms to change over time.
加密算法将减少计算量。因此，密码算法的实现应该是模块化的，这样就可以很容易地插入新的算法。也就是说，实现者应该准备好一组强制算法，以实现随时间变化的算法。
Signer and verifier systems shall be able to process an electronic signature in accordance with the specification of the signature policy signature policy referenced identifiable by an Object Identifier, see section 3.
签名者和验证者系统应能够根据签名策略规范处理电子签名，签名策略可由对象标识符识别，见第3节。
[TS101733] ETSI Standard TS 101 733 V.1.2.2 (2000-12) Electronic Signature Formats. Note: copies of ETSI TS 101 733 can be freely download from the ETSI web site www.etsi.org.
[TS101733]ETSI标准TS 101 733 V.1.2.2（2000-12）电子签名格式。注：ETSI TS 101 733的副本可从ETSI网站www.ETSI.org免费下载。
[ES-FORMATS] Pinkas, D., Ross, J. and N. Pope, "Electronic Signature Formats for Long Term Electronic Signatures", RFC 3126, June 2001.
[ES-格式]Pinkas，D.，Ross，J.和N.Pope，“长期电子签名的电子签名格式”，RFC3126，2001年6月。
[TSP] Adams, C, Pinkas, D., Zuccherato, R. and P. Cain, "Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)", RFC 3161, August 2001.
[TSP]Adams，C，Pinkas，D.，Zuccherato，R.和P.Cain，“互联网X.509公钥基础设施时间戳协议（TSP）”，RFC 31612001年8月。
[OCSP] Myers, M., Ankney, R., Malpani, R., Galperin, S. and C. Adams, "On-line Status Certificate Protocol", RFC 2560, June 1999.
[OCSP]Myers，M.，Ankney，R.，Malpani，R.，Galperin，S.和C.Adams，“在线状态证书协议”，RFC 25601999年6月。
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2119]Bradner，S.，“RFC中用于表示需求水平的关键词”，BCP 14，RFC 2119，1997年3月。
[ESS] Hoffman, P., "Enhanced Security Services for S/MIME", RFC 2634, June 1999.
[ESS]Hoffman，P.，“S/MIME的增强安全服务”，RFC 2634，1999年6月。
[CMS] Housley, R., "Cryptographic Message Syntax", RFC 2630, June 1999.
[CMS]Housley，R.，“加密消息语法”，RFC 2630，1999年6月。
[RFC2459] Housley, R., Ford, W., Polk, W. and D. Solo, "Internet X.509 Public Key Infrastructure, Certificate and CRL Profile," RFC 2459, January 1999.
[RFC2459]Housley，R.，Ford，W.，Polk，W.和D.Solo，“Internet X.509公钥基础设施，证书和CRL配置文件”，RFC 2459，1999年1月。
[PKCS9] RSA Laboratories, "The Public-Key Cryptography Standards (PKCS)", RSA Data Security Inc., Redwood City, California, November 1993 Release.
[PKCS9]RSA实验室，“公钥加密标准（PKCS）”，RSA数据安全公司，加利福尼亚州红木市，1993年11月发布。
[ISONR] ISO/IEC 10181-5: Security Frameworks in Open Systems. Non-Repudiation Framework. April 1997.
[ISONR]ISO/IEC 10181-5：开放系统中的安全框架。不可否认框架。1997年4月。
This Experimental RFC has been produced in ETSI TC-SEC.
该实验性RFC已在ETSI TC-SEC中产生。
ETSI
F-06921 Sophia Antipolis, Cedex - FRANCE
650 Route des Lucioles - Sophia Antipolis
Valbonne - FranceTel: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16
secretariat@etsi.fr
http://www.etsi.org
ETSI
F-06921 Sophia Antipolis, Cedex - FRANCE
650 Route des Lucioles - Sophia Antipolis
Valbonne - FranceTel: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16
secretariat@etsi.fr
http://www.etsi.org
Contact Point
接触点
Harri Rasilainen ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex FRANCE
Harri Rasilainen ETSI 650路des Lucioles F-06921 Sophia Antipolis Cedex法国
EMail: harri.rasilainen@etsi.fr
EMail: harri.rasilainen@etsi.fr
John Ross Security & Standards 192 Moulsham Street Chelmsford, Essex CM2 0LG United Kingdom
英国埃塞克斯郡切姆斯福德莫尔沙姆街192号约翰·罗斯安全与标准公司
EMail: ross@secstan.com
EMail: ross@secstan.com
Denis Pinkas Integris, Bull. 68, Route de Versailles 78434 Louveciennes CEDEX FRANCE
丹尼斯·平卡斯，公牛。68，凡尔赛路78434法国卢维西恩塞德克斯
EMail: Denis.Pinkas@bull.net
EMail: Denis.Pinkas@bull.net
Nick Pope Security & Standards 192 Moulsham Street Chelmsford, Essex CM2 0LG United Kingdom EMail: pope@secstan.com
Nick Pope Security&Standards 192 Moulsham Street Chelmsford，Essex CM2 0LG英国电子邮件：pope@secstan.com
Annex A (normative):
附件A（规范性附录）：
ASN.1 Definitions This annex provides the reference definition of the ASN.1 syntax signature policies definitions for new syntax defined in this document.
ASN.1定义本附件提供了ASN.1语法签名策略的参考定义，用于本文件中定义的新语法。
NOTE: The ASN.1 Module defined in section A.1 has precedence over that defined in Annex A-2 in the case of any conflict.
注：在任何冲突情况下，第A.1节中定义的ASN.1模块优先于附录A-2中定义的模块。
ETS-ElectronicSignaturePolicies-88syntax { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-mod(0)
7}
ETS-ElectronicSignaturePolicies-88syntax { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-mod(0)
7}
DEFINITIONS EXPLICIT TAGS ::=
BEGIN
-- EXPORTS All
DEFINITIONS EXPLICIT TAGS ::=
BEGIN
-- EXPORTS All
IMPORTS
进口
-- Internet X.509 Public Key Infrastructure - Certificate and CRL Profile: RFC 2560 Certificate, AlgorithmIdentifier, CertificateList, Name, GeneralNames, GeneralName, DirectoryString,Attribute, AttributeTypeAndValue, AttributeType, AttributeValue, PolicyInformation, BMPString, UTF8String
--Internet X.509公钥基础设施-证书和CRL配置文件：RFC 2560证书、算法标识符、证书列表、名称、通用名称、通用名称、目录字符串、属性、属性、属性值、属性值、属性值、属性值、策略信息、BMPString、UTF8String
FROM PKIX1Explicit88
{iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-pkix1-explicit-88(1)}
;
FROM PKIX1Explicit88
{iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-pkix1-explicit-88(1)}
;
-- Signature Policy Specification
-- ==============================
-- Signature Policy Specification
-- ==============================
SignaturePolicy ::= SEQUENCE {
signPolicyHashAlg AlgorithmIdentifier,
signPolicyInfo SignPolicyInfo,
signPolicyHash SignPolicyHash OPTIONAL }
SignaturePolicy ::= SEQUENCE {
signPolicyHashAlg AlgorithmIdentifier,
signPolicyInfo SignPolicyInfo,
signPolicyHash SignPolicyHash OPTIONAL }
SignPolicyHash ::= OCTET STRING
SignPolicyHash ::= OCTET STRING
SignPolicyInfo ::= SEQUENCE {
signPolicyIdentifier SignPolicyId,
dateOfIssue GeneralizedTime,
policyIssuerName PolicyIssuerName,
SignPolicyInfo ::= SEQUENCE {
signPolicyIdentifier SignPolicyId,
dateOfIssue GeneralizedTime,
policyIssuerName PolicyIssuerName,
fieldOfApplication FieldOfApplication, signatureValidationPolicy SignatureValidationPolicy, signPolExtensions SignPolExtensions OPTIONAL }
应用程序域应用程序域，signatureValidationPolicy signatureValidationPolicy，signPolExtensions signPolExtensions可选}
PolicyIssuerName ::= GeneralNames
PolicyIssuerName ::= GeneralNames
FieldOfApplication ::= DirectoryString
FieldOfApplication ::= DirectoryString
SignatureValidationPolicy ::= SEQUENCE {
signingPeriod SigningPeriod,
commonRules CommonRules,
commitmentRules CommitmentRules,
signPolExtensions SignPolExtensions
OPTIONAL
}
SignatureValidationPolicy ::= SEQUENCE {
signingPeriod SigningPeriod,
commonRules CommonRules,
commitmentRules CommitmentRules,
signPolExtensions SignPolExtensions
OPTIONAL
}
SigningPeriod ::= SEQUENCE {
notBefore GeneralizedTime,
notAfter GeneralizedTime OPTIONAL }
SigningPeriod ::= SEQUENCE {
notBefore GeneralizedTime,
notAfter GeneralizedTime OPTIONAL }
CommonRules ::= SEQUENCE {
signerAndVeriferRules [0] SignerAndVerifierRules
OPTIONAL,
signingCertTrustCondition [1] SigningCertTrustCondition
OPTIONAL,
timeStampTrustCondition [2] TimestampTrustCondition
OPTIONAL,
attributeTrustCondition [3] AttributeTrustCondition
OPTIONAL,
algorithmConstraintSet [4] AlgorithmConstraintSet
OPTIONAL,
signPolExtensions [5] SignPolExtensions
OPTIONAL
}
CommonRules ::= SEQUENCE {
signerAndVeriferRules [0] SignerAndVerifierRules
OPTIONAL,
signingCertTrustCondition [1] SigningCertTrustCondition
OPTIONAL,
timeStampTrustCondition [2] TimestampTrustCondition
OPTIONAL,
attributeTrustCondition [3] AttributeTrustCondition
OPTIONAL,
algorithmConstraintSet [4] AlgorithmConstraintSet
OPTIONAL,
signPolExtensions [5] SignPolExtensions
OPTIONAL
}
CommitmentRules ::= SEQUENCE OF CommitmentRule
CommitmentRules ::= SEQUENCE OF CommitmentRule
CommitmentRule ::= SEQUENCE {
selCommitmentTypes SelectedCommitmentTypes,
signerAndVeriferRules [0] SignerAndVerifierRules
OPTIONAL,
signingCertTrustCondition [1] SigningCertTrustCondition
OPTIONAL,
timeStampTrustCondition [2] TimestampTrustCondition
OPTIONAL,
CommitmentRule ::= SEQUENCE {
selCommitmentTypes SelectedCommitmentTypes,
signerAndVeriferRules [0] SignerAndVerifierRules
OPTIONAL,
signingCertTrustCondition [1] SigningCertTrustCondition
OPTIONAL,
timeStampTrustCondition [2] TimestampTrustCondition
OPTIONAL,
attributeTrustCondition [3] AttributeTrustCondition
OPTIONAL,
algorithmConstraintSet [4] AlgorithmConstraintSet
OPTIONAL,
signPolExtensions [5] SignPolExtensions
OPTIONAL
}
SelectedCommitmentTypes ::= SEQUENCE OF CHOICE {
empty NULL,
recognizedCommitmentType CommitmentType }
attributeTrustCondition [3] AttributeTrustCondition
OPTIONAL,
algorithmConstraintSet [4] AlgorithmConstraintSet
OPTIONAL,
signPolExtensions [5] SignPolExtensions
OPTIONAL
}
SelectedCommitmentTypes ::= SEQUENCE OF CHOICE {
empty NULL,
recognizedCommitmentType CommitmentType }
CommitmentType ::= SEQUENCE {
identifier CommitmentTypeIdentifier,
fieldOfApplication [0] FieldOfApplication OPTIONAL,
semantics [1] DirectoryString OPTIONAL }
CommitmentType ::= SEQUENCE {
identifier CommitmentTypeIdentifier,
fieldOfApplication [0] FieldOfApplication OPTIONAL,
semantics [1] DirectoryString OPTIONAL }
SignerAndVerifierRules ::= SEQUENCE {
signerRules SignerRules,
verifierRules VerifierRules }
SignerAndVerifierRules ::= SEQUENCE {
signerRules SignerRules,
verifierRules VerifierRules }
SignerRules ::= SEQUENCE {
externalSignedData BOOLEAN OPTIONAL,
-- True if signed data is external to CMS structure
-- False if signed data part of CMS structure
-- not present if either allowed
mandatedSignedAttr CMSAttrs,
-- Mandated CMS signed attributes
mandatedUnsignedAttr CMSAttrs,
-- Mandated CMS unsigned attributed
mandatedCertificateRef [0] CertRefReq DEFAULT signerOnly,
-- Mandated Certificate Reference
mandatedCertificateInfo [1] CertInfoReq DEFAULT none,
-- Mandated Certificate Info
signPolExtensions [2] SignPolExtensions
OPTIONAL}
SignerRules ::= SEQUENCE {
externalSignedData BOOLEAN OPTIONAL,
-- True if signed data is external to CMS structure
-- False if signed data part of CMS structure
-- not present if either allowed
mandatedSignedAttr CMSAttrs,
-- Mandated CMS signed attributes
mandatedUnsignedAttr CMSAttrs,
-- Mandated CMS unsigned attributed
mandatedCertificateRef [0] CertRefReq DEFAULT signerOnly,
-- Mandated Certificate Reference
mandatedCertificateInfo [1] CertInfoReq DEFAULT none,
-- Mandated Certificate Info
signPolExtensions [2] SignPolExtensions
OPTIONAL}
CMSAttrs ::= SEQUENCE OF OBJECT IDENTIFIER
CMSAttrs ::= SEQUENCE OF OBJECT IDENTIFIER
CertRefReq ::= ENUMERATED {
signerOnly (1),
-- Only reference to signer cert mandated
fullPath (2)
-- References for full cert path up to a trust point required
CertRefReq ::= ENUMERATED {
signerOnly (1),
-- Only reference to signer cert mandated
fullPath (2)
-- References for full cert path up to a trust point required
}
}
CertInfoReq ::= ENUMERATED {
CertInfoReq ::= ENUMERATED {
none (0),
-- No mandatory requirements
signerOnly (1),
-- Only reference to signer cert mandated
fullPath (2)
-- References for full cert path up to a trust point mandated
}
none (0),
-- No mandatory requirements
signerOnly (1),
-- Only reference to signer cert mandated
fullPath (2)
-- References for full cert path up to a trust point mandated
}
VerifierRules ::= SEQUENCE {
mandatedUnsignedAttr MandatedUnsignedAttr,
signPolExtensions SignPolExtensions OPTIONAL
}
VerifierRules ::= SEQUENCE {
mandatedUnsignedAttr MandatedUnsignedAttr,
signPolExtensions SignPolExtensions OPTIONAL
}
MandatedUnsignedAttr ::= CMSAttrs
-- Mandated CMS unsigned attributed
MandatedUnsignedAttr ::= CMSAttrs
-- Mandated CMS unsigned attributed
CertificateTrustTrees ::= SEQUENCE OF CertificateTrustPoint
CertificateTrustTrees ::= SEQUENCE OF CertificateTrustPoint
CertificateTrustPoint ::= SEQUENCE {
trustpoint Certificate,
-- self-signed certificate
pathLenConstraint [0] PathLenConstraint OPTIONAL,
acceptablePolicySet [1] AcceptablePolicySet OPTIONAL,
-- If not present "any policy"
nameConstraints [2] NameConstraints OPTIONAL,
policyConstraints [3] PolicyConstraints OPTIONAL }
CertificateTrustPoint ::= SEQUENCE {
trustpoint Certificate,
-- self-signed certificate
pathLenConstraint [0] PathLenConstraint OPTIONAL,
acceptablePolicySet [1] AcceptablePolicySet OPTIONAL,
-- If not present "any policy"
nameConstraints [2] NameConstraints OPTIONAL,
policyConstraints [3] PolicyConstraints OPTIONAL }
PathLenConstraint ::= INTEGER (0..MAX)
PathLenConstraint ::= INTEGER (0..MAX)
AcceptablePolicySet ::= SEQUENCE OF CertPolicyId
AcceptablePolicySet ::= SEQUENCE OF CertPolicyId
CertPolicyId ::= OBJECT IDENTIFIER
CertPolicyId ::= OBJECT IDENTIFIER
NameConstraints ::= SEQUENCE {
permittedSubtrees [0] GeneralSubtrees OPTIONAL,
excludedSubtrees [1] GeneralSubtrees OPTIONAL }
NameConstraints ::= SEQUENCE {
permittedSubtrees [0] GeneralSubtrees OPTIONAL,
excludedSubtrees [1] GeneralSubtrees OPTIONAL }
GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
GeneralSubtree ::= SEQUENCE {
base GeneralName,
minimum [0] BaseDistance DEFAULT 0,
maximum [1] BaseDistance OPTIONAL }
GeneralSubtree ::= SEQUENCE {
base GeneralName,
minimum [0] BaseDistance DEFAULT 0,
maximum [1] BaseDistance OPTIONAL }
BaseDistance ::= INTEGER (0..MAX)
BaseDistance ::= INTEGER (0..MAX)
PolicyConstraints ::= SEQUENCE {
requireExplicitPolicy [0] SkipCerts OPTIONAL,
PolicyConstraints ::= SEQUENCE {
requireExplicitPolicy [0] SkipCerts OPTIONAL,
inhibitPolicyMapping [1] SkipCerts OPTIONAL }
禁止策略映射[1]SkipCerts可选}
SkipCerts ::= INTEGER (0..MAX)
SkipCerts ::= INTEGER (0..MAX)
CertRevReq ::= SEQUENCE {
endCertRevReq RevReq,
caCerts [0] RevReq
}
CertRevReq ::= SEQUENCE {
endCertRevReq RevReq,
caCerts [0] RevReq
}
RevReq ::= SEQUENCE {
enuRevReq EnuRevReq,
exRevReq SignPolExtensions OPTIONAL}
RevReq ::= SEQUENCE {
enuRevReq EnuRevReq,
exRevReq SignPolExtensions OPTIONAL}
EnuRevReq ::= ENUMERATED {
clrCheck (0), --Checks must be made against current CRLs
-- (or authority revocation lists)
ocspCheck (1), -- The revocation status must be checked
-- using the Online Certificate Status Protocol (RFC 2450)
bothCheck (2),
-- Both CRL and OCSP checks must be carried out
eitherCheck (3),
-- At least one of CRL or OCSP checks must be carried out
noCheck (4),
-- no check is mandated
other (5)
-- Other mechanism as defined by signature policy extension
}
EnuRevReq ::= ENUMERATED {
clrCheck (0), --Checks must be made against current CRLs
-- (or authority revocation lists)
ocspCheck (1), -- The revocation status must be checked
-- using the Online Certificate Status Protocol (RFC 2450)
bothCheck (2),
-- Both CRL and OCSP checks must be carried out
eitherCheck (3),
-- At least one of CRL or OCSP checks must be carried out
noCheck (4),
-- no check is mandated
other (5)
-- Other mechanism as defined by signature policy extension
}
SigningCertTrustCondition ::= SEQUENCE {
signerTrustTrees CertificateTrustTrees,
signerRevReq CertRevReq
}
SigningCertTrustCondition ::= SEQUENCE {
signerTrustTrees CertificateTrustTrees,
signerRevReq CertRevReq
}
TimestampTrustCondition ::= SEQUENCE {
ttsCertificateTrustTrees [0] CertificateTrustTrees
OPTIONAL,
ttsRevReq [1] CertRevReq
OPTIONAL,
ttsNameConstraints [2] NameConstraints
OPTIONAL,
cautionPeriod [3] DeltaTime
OPTIONAL,
signatureTimestampDelay [4] DeltaTime
OPTIONAL }
TimestampTrustCondition ::= SEQUENCE {
ttsCertificateTrustTrees [0] CertificateTrustTrees
OPTIONAL,
ttsRevReq [1] CertRevReq
OPTIONAL,
ttsNameConstraints [2] NameConstraints
OPTIONAL,
cautionPeriod [3] DeltaTime
OPTIONAL,
signatureTimestampDelay [4] DeltaTime
OPTIONAL }
DeltaTime ::= SEQUENCE {
deltaSeconds INTEGER,
deltaMinutes INTEGER,
DeltaTime ::= SEQUENCE {
deltaSeconds INTEGER,
deltaMinutes INTEGER,
deltaHours INTEGER, deltaDays INTEGER }
deltaHours整数，deltaDays整数}
AttributeTrustCondition ::= SEQUENCE {
attributeMandated BOOLEAN,
-- Attribute must be present
howCertAttribute HowCertAttribute,
attrCertificateTrustTrees [0] CertificateTrustTrees OPTIONAL,
attrRevReq [1] CertRevReq OPTIONAL,
attributeConstraints [2] AttributeConstraints OPTIONAL }
AttributeTrustCondition ::= SEQUENCE {
attributeMandated BOOLEAN,
-- Attribute must be present
howCertAttribute HowCertAttribute,
attrCertificateTrustTrees [0] CertificateTrustTrees OPTIONAL,
attrRevReq [1] CertRevReq OPTIONAL,
attributeConstraints [2] AttributeConstraints OPTIONAL }
HowCertAttribute ::= ENUMERATED {
claimedAttribute (0),
certifiedAttribtes (1),
either (2) }
HowCertAttribute ::= ENUMERATED {
claimedAttribute (0),
certifiedAttribtes (1),
either (2) }
AttributeConstraints ::= SEQUENCE {
attributeTypeConstarints [0] AttributeTypeConstraints
OPTIONAL,
attributeValueConstarints [1] AttributeValueConstraints
OPTIONAL }
AttributeConstraints ::= SEQUENCE {
attributeTypeConstarints [0] AttributeTypeConstraints
OPTIONAL,
attributeValueConstarints [1] AttributeValueConstraints
OPTIONAL }
AttributeTypeConstraints ::= SEQUENCE OF AttributeType
AttributeTypeConstraints ::= SEQUENCE OF AttributeType
AttributeValueConstraints ::= SEQUENCE OF AttributeTypeAndValue
AttributeValueConstraints ::= SEQUENCE OF AttributeTypeAndValue
AlgorithmConstraintSet ::= SEQUENCE { -- Algorithm constrains on:
signerAlgorithmConstraints [0] AlgorithmConstraints OPTIONAL,
-- signer
eeCertAlgorithmConstraints [1] AlgorithmConstraints OPTIONAL,
-- issuer of end entity certs.
caCertAlgorithmConstraints [2] AlgorithmConstraints OPTIONAL,
-- issuer of CA certificates
aaCertAlgorithmConstraints [3] AlgorithmConstraints OPTIONAL,
-- Attribute Authority
tsaCertAlgorithmConstraints [4] AlgorithmConstraints OPTIONAL
-- Time-Stamping Authority
}
AlgorithmConstraintSet ::= SEQUENCE { -- Algorithm constrains on:
signerAlgorithmConstraints [0] AlgorithmConstraints OPTIONAL,
-- signer
eeCertAlgorithmConstraints [1] AlgorithmConstraints OPTIONAL,
-- issuer of end entity certs.
caCertAlgorithmConstraints [2] AlgorithmConstraints OPTIONAL,
-- issuer of CA certificates
aaCertAlgorithmConstraints [3] AlgorithmConstraints OPTIONAL,
-- Attribute Authority
tsaCertAlgorithmConstraints [4] AlgorithmConstraints OPTIONAL
-- Time-Stamping Authority
}
AlgorithmConstraints ::= SEQUENCE OF AlgAndLength
AlgorithmConstraints ::= SEQUENCE OF AlgAndLength
AlgAndLength ::= SEQUENCE {
algID OBJECT IDENTIFIER,
minKeyLength INTEGER OPTIONAL,
-- Minimum key length in bits other
SignPolExtensions OPTIONAL
AlgAndLength ::= SEQUENCE {
algID OBJECT IDENTIFIER,
minKeyLength INTEGER OPTIONAL,
-- Minimum key length in bits other
SignPolExtensions OPTIONAL
}
}
SignPolExtensions ::= SEQUENCE OF SignPolExtn
SignPolExtensions ::= SEQUENCE OF SignPolExtn
SignPolExtn ::= SEQUENCE {
extnID OBJECT IDENTIFIER,
extnValue OCTET STRING }
SignPolExtn ::= SEQUENCE {
extnID OBJECT IDENTIFIER,
extnValue OCTET STRING }
END -- ETS-ElectronicSignaturePolicies-88syntax --
结束--ETS-ElectronicsignaturePolicys-88语法--
NOTE: The ASN.1 module defined in section A.1 has precedence over that defined in section A.2 in the case of any conflict.
注：在任何冲突情况下，第A.1节中定义的ASN.1模块优先于第A.2节中定义的模块。
ETS-ElectronicSignaturePolicies-97Syntax { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-mod(0) 8}
ETS-ElectronicSignaturePolicies-97Syntax { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-mod(0) 8}
DEFINITIONS EXPLICIT TAGS ::=
BEGIN
-- EXPORTS All -
DEFINITIONS EXPLICIT TAGS ::=
BEGIN
-- EXPORTS All -
IMPORTS
进口
-- Internet X.509 Public Key Infrastructure
-- Certificate and CRL Profile: RFC 2560
Certificate, AlgorithmIdentifier, CertificateList, Name,
GeneralNames, GeneralName, DirectoryString, Attribute,
AttributeTypeAndValue, AttributeType, AttributeValue,
PolicyInformation
-- Internet X.509 Public Key Infrastructure
-- Certificate and CRL Profile: RFC 2560
Certificate, AlgorithmIdentifier, CertificateList, Name,
GeneralNames, GeneralName, DirectoryString, Attribute,
AttributeTypeAndValue, AttributeType, AttributeValue,
PolicyInformation
FROM PKIX1Explicit93
{iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
nid-pkix1-explicit-88(1)}
;
FROM PKIX1Explicit93
{iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
nid-pkix1-explicit-88(1)}
;
-- S/MIME Object Identifier arcs used in the present document
-- ==================================================================
-- S/MIME Object Identifier arcs used in the present document
-- ==================================================================
-- S/MIME OID arc used in the present document
-- id-smime OBJECT IDENTIFIER ::= { iso(1) member-body(2)
-- us(840) rsadsi(113549) pkcs(1) pkcs-9(9) 16 }
-- S/MIME OID arc used in the present document
-- id-smime OBJECT IDENTIFIER ::= { iso(1) member-body(2)
-- us(840) rsadsi(113549) pkcs(1) pkcs-9(9) 16 }
-- S/MIME Arcs
-- id-mod OBJECT IDENTIFIER ::= { id-smime 0 }
-- modules
-- S/MIME Arcs
-- id-mod OBJECT IDENTIFIER ::= { id-smime 0 }
-- modules
-- id-ct OBJECT IDENTIFIER ::= { id-smime 1 }
-- content types
-- id-aa OBJECT IDENTIFIER ::= { id-smime 2 }
-- attributes
-- id-spq OBJECT IDENTIFIER ::= { id-smime 5 }
-- signature policy qualifier
-- id-cti OBJECT IDENTIFIER ::= { id-smime 6 }
-- commitment type identifier
-- Signature Policy Specification
-- ==============================
-- id-ct OBJECT IDENTIFIER ::= { id-smime 1 }
-- content types
-- id-aa OBJECT IDENTIFIER ::= { id-smime 2 }
-- attributes
-- id-spq OBJECT IDENTIFIER ::= { id-smime 5 }
-- signature policy qualifier
-- id-cti OBJECT IDENTIFIER ::= { id-smime 6 }
-- commitment type identifier
-- Signature Policy Specification
-- ==============================
SignaturePolicy ::= SEQUENCE {
signPolicyHashAlg AlgorithmIdentifier,
signPolicyInfo SignPolicyInfo,
signPolicyHash SignPolicyHash OPTIONAL }
SignaturePolicy ::= SEQUENCE {
signPolicyHashAlg AlgorithmIdentifier,
signPolicyInfo SignPolicyInfo,
signPolicyHash SignPolicyHash OPTIONAL }
SignPolicyHash ::= OCTET STRING
SignPolicyHash ::= OCTET STRING
SignPolicyInfo ::= SEQUENCE {
signPolicyIdentifier SignPolicyId,
dateOfIssue GeneralizedTime,
policyIssuerName PolicyIssuerName,
fieldOfApplication FieldOfApplication,
signatureValidationPolicy SignatureValidationPolicy,
signPolExtensions SignPolExtensions
OPTIONAL
}
SignPolicyInfo ::= SEQUENCE {
signPolicyIdentifier SignPolicyId,
dateOfIssue GeneralizedTime,
policyIssuerName PolicyIssuerName,
fieldOfApplication FieldOfApplication,
signatureValidationPolicy SignatureValidationPolicy,
signPolExtensions SignPolExtensions
OPTIONAL
}
SignPolicyId ::= OBJECT IDENTIFIER
SignPolicyId ::= OBJECT IDENTIFIER
PolicyIssuerName ::= GeneralNames
PolicyIssuerName ::= GeneralNames
FieldOfApplication ::= DirectoryString
FieldOfApplication ::= DirectoryString
SignatureValidationPolicy ::= SEQUENCE {
signingPeriod SigningPeriod,
commonRules CommonRules,
commitmentRules CommitmentRules,
signPolExtensions SignPolExtensions OPTIONAL
}
SignatureValidationPolicy ::= SEQUENCE {
signingPeriod SigningPeriod,
commonRules CommonRules,
commitmentRules CommitmentRules,
signPolExtensions SignPolExtensions OPTIONAL
}
SigningPeriod ::= SEQUENCE {
notBefore GeneralizedTime,
notAfter GeneralizedTime OPTIONAL }
SigningPeriod ::= SEQUENCE {
notBefore GeneralizedTime,
notAfter GeneralizedTime OPTIONAL }
CommonRules ::= SEQUENCE {
signerAndVeriferRules [0] SignerAndVerifierRules
OPTIONAL,
CommonRules ::= SEQUENCE {
signerAndVeriferRules [0] SignerAndVerifierRules
OPTIONAL,
signingCertTrustCondition [1] SigningCertTrustCondition OPTIONAL, timeStampTrustCondition [2] TimestampTrustCondition OPTIONAL, attributeTrustCondition [3] AttributeTrustCondition OPTIONAL, algorithmConstraintSet [4] AlgorithmConstraintSet OPTIONAL, signPolExtensions [5] SignPolExtensions OPTIONAL }
signingCertTrustCondition[1]signingCertTrustCondition可选，timeStampTrustCondition[2]timeStampTrustCondition可选，attributeTrustCondition[3]attributeTrustCondition可选，algorithmConstraintSet[4]algorithmConstraintSet可选，signPolExtensions[5]signPolExtensions可选}
CommitmentRules ::= SEQUENCE OF CommitmentRule
CommitmentRules ::= SEQUENCE OF CommitmentRule
CommitmentRule ::= SEQUENCE {
selCommitmentTypes SelectedCommitmentTypes,
signerAndVeriferRules [0] SignerAndVerifierRules
OPTIONAL,
signingCertTrustCondition [1] SigningCertTrustCondition
OPTIONAL,
timeStampTrustCondition [2] TimestampTrustCondition
OPTIONAL,
attributeTrustCondition [3] AttributeTrustCondition
OPTIONAL,
algorithmConstraintSet [4] AlgorithmConstraintSet
OPTIONAL,
signPolExtensions [5] SignPolExtensions
OPTIONAL
}
CommitmentRule ::= SEQUENCE {
selCommitmentTypes SelectedCommitmentTypes,
signerAndVeriferRules [0] SignerAndVerifierRules
OPTIONAL,
signingCertTrustCondition [1] SigningCertTrustCondition
OPTIONAL,
timeStampTrustCondition [2] TimestampTrustCondition
OPTIONAL,
attributeTrustCondition [3] AttributeTrustCondition
OPTIONAL,
algorithmConstraintSet [4] AlgorithmConstraintSet
OPTIONAL,
signPolExtensions [5] SignPolExtensions
OPTIONAL
}
SelectedCommitmentTypes ::= SEQUENCE OF CHOICE {
empty NULL,
recognizedCommitmentType CommitmentType }
SelectedCommitmentTypes ::= SEQUENCE OF CHOICE {
empty NULL,
recognizedCommitmentType CommitmentType }
CommitmentType ::= SEQUENCE {
identifier CommitmentTypeIdentifier,
fieldOfApplication [0] FieldOfApplication OPTIONAL,
semantics [1] DirectoryString OPTIONAL }
CommitmentType ::= SEQUENCE {
identifier CommitmentTypeIdentifier,
fieldOfApplication [0] FieldOfApplication OPTIONAL,
semantics [1] DirectoryString OPTIONAL }
SignerAndVerifierRules ::= SEQUENCE {
signerRules SignerRules,
verifierRules VerifierRules }
SignerAndVerifierRules ::= SEQUENCE {
signerRules SignerRules,
verifierRules VerifierRules }
SignerRules ::= SEQUENCE {
externalSignedData BOOLEAN OPTIONAL,
-- True if signed data is external to CMS structure
-- False if signed data part of CMS structure
-- not present if either allowed
SignerRules ::= SEQUENCE {
externalSignedData BOOLEAN OPTIONAL,
-- True if signed data is external to CMS structure
-- False if signed data part of CMS structure
-- not present if either allowed
mandatedSignedAttr CMSAttrs,
-- Mandated CMS signed attributes
mandatedUnsignedAttr CMSAttrs,
-- Mandated CMS unsigned attributed
mandatedCertificateRef [0] CertRefReq DEFAULT signerOnly,
-- Mandated Certificate Reference
mandatedCertificateInfo [1] CertInfoReq DEFAULT none,
-- Mandated Certificate Info
signPolExtensions [2] SignPolExtensions OPTIONAL
}
mandatedSignedAttr CMSAttrs,
-- Mandated CMS signed attributes
mandatedUnsignedAttr CMSAttrs,
-- Mandated CMS unsigned attributed
mandatedCertificateRef [0] CertRefReq DEFAULT signerOnly,
-- Mandated Certificate Reference
mandatedCertificateInfo [1] CertInfoReq DEFAULT none,
-- Mandated Certificate Info
signPolExtensions [2] SignPolExtensions OPTIONAL
}
CMSAttrs ::= SEQUENCE OF OBJECT IDENTIFIER
CMSAttrs ::= SEQUENCE OF OBJECT IDENTIFIER
CertRefReq ::= ENUMERATED {
signerOnly (1),
-- Only reference to signer cert mandated
fullPath (2)
-- References for full cert path up to a trust
-- point required
}
CertRefReq ::= ENUMERATED {
signerOnly (1),
-- Only reference to signer cert mandated
fullPath (2)
-- References for full cert path up to a trust
-- point required
}
CertInfoReq ::= ENUMERATED {
none (0) ,
-- No mandatory requirements
signerOnly (1) ,
-- Only reference to signer cert mandated
fullPath (2)
-- References for full cert path up to a
-- trust point mandated
}
CertInfoReq ::= ENUMERATED {
none (0) ,
-- No mandatory requirements
signerOnly (1) ,
-- Only reference to signer cert mandated
fullPath (2)
-- References for full cert path up to a
-- trust point mandated
}
VerifierRules ::= SEQUENCE {
mandatedUnsignedAttr MandatedUnsignedAttr,
signPolExtensions SignPolExtensions OPTIONAL
}
MandatedUnsignedAttr ::= CMSAttrs
-- Mandated CMS unsigned attributed
VerifierRules ::= SEQUENCE {
mandatedUnsignedAttr MandatedUnsignedAttr,
signPolExtensions SignPolExtensions OPTIONAL
}
MandatedUnsignedAttr ::= CMSAttrs
-- Mandated CMS unsigned attributed
CertificateTrustTrees ::= SEQUENCE OF CertificateTrustPoint
CertificateTrustTrees ::= SEQUENCE OF CertificateTrustPoint
CertificateTrustPoint ::= SEQUENCE {
trustpoint Certificate,
-- self-signed certificate
pathLenConstraint [0] PathLenConstraint OPTIONAL,
acceptablePolicySet [1] AcceptablePolicySet OPTIONAL,
-- If not present "any policy"
nameConstraints [2] NameConstraints OPTIONAL,
policyConstraints [3] PolicyConstraints OPTIONAL }
CertificateTrustPoint ::= SEQUENCE {
trustpoint Certificate,
-- self-signed certificate
pathLenConstraint [0] PathLenConstraint OPTIONAL,
acceptablePolicySet [1] AcceptablePolicySet OPTIONAL,
-- If not present "any policy"
nameConstraints [2] NameConstraints OPTIONAL,
policyConstraints [3] PolicyConstraints OPTIONAL }
PathLenConstraint ::= INTEGER (0..MAX)
PathLenConstraint ::= INTEGER (0..MAX)
AcceptablePolicySet ::= SEQUENCE OF CertPolicyId
AcceptablePolicySet ::= SEQUENCE OF CertPolicyId
CertPolicyId ::= OBJECT IDENTIFIER
CertPolicyId ::= OBJECT IDENTIFIER
NameConstraints ::= SEQUENCE {
permittedSubtrees [0] GeneralSubtrees OPTIONAL,
excludedSubtrees [1] GeneralSubtrees OPTIONAL }
NameConstraints ::= SEQUENCE {
permittedSubtrees [0] GeneralSubtrees OPTIONAL,
excludedSubtrees [1] GeneralSubtrees OPTIONAL }
GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
GeneralSubtree ::= SEQUENCE {
base GeneralName,
minimum [0] BaseDistance DEFAULT 0,
maximum [1] BaseDistance OPTIONAL }
GeneralSubtree ::= SEQUENCE {
base GeneralName,
minimum [0] BaseDistance DEFAULT 0,
maximum [1] BaseDistance OPTIONAL }
BaseDistance ::= INTEGER (0..MAX)
BaseDistance ::= INTEGER (0..MAX)
PolicyConstraints ::= SEQUENCE {
requireExplicitPolicy [0] SkipCerts OPTIONAL,
inhibitPolicyMapping [1] SkipCerts OPTIONAL }
PolicyConstraints ::= SEQUENCE {
requireExplicitPolicy [0] SkipCerts OPTIONAL,
inhibitPolicyMapping [1] SkipCerts OPTIONAL }
SkipCerts ::= INTEGER (0..MAX)
SkipCerts ::= INTEGER (0..MAX)
CertRevReq ::= SEQUENCE {
endCertRevReq RevReq,
caCerts [0] RevReq
}
CertRevReq ::= SEQUENCE {
endCertRevReq RevReq,
caCerts [0] RevReq
}
RevReq ::= SEQUENCE {
enuRevReq EnuRevReq,
exRevReq SignPolExtensions OPTIONAL}
RevReq ::= SEQUENCE {
enuRevReq EnuRevReq,
exRevReq SignPolExtensions OPTIONAL}
EnuRevReq ::= ENUMERATED {
clrCheck (0),
-- Checks must be made against current CRLs
-- (or authority revocation lists)
ocspCheck (1),
-- The revocation status must be checked using
-- the Online Certificate Status Protocol (RFC 2450)
bothCheck (2),
-- Both CRL and OCSP checks must be carried out
eitherCheck (3),
-- At least one of CRL or OCSP checks must be
-- carried out
noCheck (4),
-- no check is mandated
EnuRevReq ::= ENUMERATED {
clrCheck (0),
-- Checks must be made against current CRLs
-- (or authority revocation lists)
ocspCheck (1),
-- The revocation status must be checked using
-- the Online Certificate Status Protocol (RFC 2450)
bothCheck (2),
-- Both CRL and OCSP checks must be carried out
eitherCheck (3),
-- At least one of CRL or OCSP checks must be
-- carried out
noCheck (4),
-- no check is mandated
other (5)
-- Other mechanism as defined by signature policy
-- extension
}
other (5)
-- Other mechanism as defined by signature policy
-- extension
}
SigningCertTrustCondition ::= SEQUENCE {
signerTrustTrees CertificateTrustTrees,
signerRevReq CertRevReq
}
SigningCertTrustCondition ::= SEQUENCE {
signerTrustTrees CertificateTrustTrees,
signerRevReq CertRevReq
}
TimestampTrustCondition ::= SEQUENCE {
ttsCertificateTrustTrees [0] CertificateTrustTrees
OPTIONAL,
ttsRevReq [1] CertRevReq
OPTIONAL,
ttsNameConstraints [2] NameConstraints
OPTIONAL,
cautionPeriod [3] DeltaTime
OPTIONAL,
signatureTimestampDelay [4] DeltaTime
OPTIONAL }
TimestampTrustCondition ::= SEQUENCE {
ttsCertificateTrustTrees [0] CertificateTrustTrees
OPTIONAL,
ttsRevReq [1] CertRevReq
OPTIONAL,
ttsNameConstraints [2] NameConstraints
OPTIONAL,
cautionPeriod [3] DeltaTime
OPTIONAL,
signatureTimestampDelay [4] DeltaTime
OPTIONAL }
DeltaTime ::= SEQUENCE {
deltaSeconds INTEGER,
deltaMinutes INTEGER,
deltaHours INTEGER,
deltaDays INTEGER }
DeltaTime ::= SEQUENCE {
deltaSeconds INTEGER,
deltaMinutes INTEGER,
deltaHours INTEGER,
deltaDays INTEGER }
AttributeTrustCondition ::= SEQUENCE {
attributeMandated BOOLEAN,
-- Attribute must be present
howCertAttribute HowCertAttribute,
attrCertificateTrustTrees [0] CertificateTrustTrees OPTIONAL,
attrRevReq [1] CertRevReq OPTIONAL,
attributeConstraints [2] AttributeConstraints OPTIONAL }
AttributeTrustCondition ::= SEQUENCE {
attributeMandated BOOLEAN,
-- Attribute must be present
howCertAttribute HowCertAttribute,
attrCertificateTrustTrees [0] CertificateTrustTrees OPTIONAL,
attrRevReq [1] CertRevReq OPTIONAL,
attributeConstraints [2] AttributeConstraints OPTIONAL }
HowCertAttribute ::= ENUMERATED {
claimedAttribute (0),
certifiedAttribtes (1),
either (2) }
HowCertAttribute ::= ENUMERATED {
claimedAttribute (0),
certifiedAttribtes (1),
either (2) }
AttributeConstraints ::= SEQUENCE {
attributeTypeConstarints [0] AttributeTypeConstraints
OPTIONAL,
attributeValueConstarints [1] AttributeValueConstraints
OPTIONAL }
AttributeConstraints ::= SEQUENCE {
attributeTypeConstarints [0] AttributeTypeConstraints
OPTIONAL,
attributeValueConstarints [1] AttributeValueConstraints
OPTIONAL }
AttributeTypeConstraints ::= SEQUENCE OF AttributeType
AttributeTypeConstraints ::= SEQUENCE OF AttributeType
AttributeValueConstraints ::= SEQUENCE OF AttributeTypeAndValue
AttributeValueConstraints ::= SEQUENCE OF AttributeTypeAndValue
AlgorithmConstraintSet ::= SEQUENCE {
-- Algorithm constrains on:
signerAlgorithmConstraints [0] AlgorithmConstraints OPTIONAL,
-- signer
eeCertAlgorithmConstraints [1] AlgorithmConstraints OPTIONAL,
-- issuer of end entity certs.
caCertAlgorithmConstraints [2] AlgorithmConstraints OPTIONAL,
-- issuer of CA certificates
aaCertAlgorithmConstraints [3] AlgorithmConstraints OPTIONAL,
-- Attribute Authority
tsaCertAlgorithmConstraints [4] AlgorithmConstraints OPTIONAL
-- Time-Stamping Authority
}
AlgorithmConstraintSet ::= SEQUENCE {
-- Algorithm constrains on:
signerAlgorithmConstraints [0] AlgorithmConstraints OPTIONAL,
-- signer
eeCertAlgorithmConstraints [1] AlgorithmConstraints OPTIONAL,
-- issuer of end entity certs.
caCertAlgorithmConstraints [2] AlgorithmConstraints OPTIONAL,
-- issuer of CA certificates
aaCertAlgorithmConstraints [3] AlgorithmConstraints OPTIONAL,
-- Attribute Authority
tsaCertAlgorithmConstraints [4] AlgorithmConstraints OPTIONAL
-- Time-Stamping Authority
}
AlgorithmConstraints ::= SEQUENCE OF AlgAndLength
AlgorithmConstraints ::= SEQUENCE OF AlgAndLength
AlgAndLength ::= SEQUENCE {
algID OBJECT IDENTIFIER,
minKeyLength INTEGER OPTIONAL,
-- Minimum key length in bits
other SignPolExtensions OPTIONAL
}
AlgAndLength ::= SEQUENCE {
algID OBJECT IDENTIFIER,
minKeyLength INTEGER OPTIONAL,
-- Minimum key length in bits
other SignPolExtensions OPTIONAL
}
SignPolExtensions ::= SEQUENCE OF SignPolExtn
SignPolExtensions ::= SEQUENCE OF SignPolExtn
SignPolExtn ::= SEQUENCE {
extnID OBJECT IDENTIFIER,
extnValue OCTET STRING }
SignPolExtn ::= SEQUENCE {
extnID OBJECT IDENTIFIER,
extnValue OCTET STRING }
END -- ETS-ElectronicPolicies-97Syntax
结束--ETS-ElectronicPolicys-972语法
Annex B (informative):
附件B（资料性）：
The definition of electronic signature mentions: "a commitment has been explicitly endorsed under a "Signature Policy", at a given time, by a signer under an identifier, e.g., a name or a pseudonym, and optionally a role."
电子签名的定义提到：“一项承诺已在某一特定时间由签名人在一个标识符（例如姓名或笔名）下明确认可，而且还可以选择一个角色。”
Electronic signatures are commonly applied within the context of a legal or contractual framework. This establishes the requirements on the electronic signatures and any special semantics (e.g., agreement, intent). These requirements may be defined in very general abstract terms or in terms of detailed rules. The specific semantics associated with an electronic signature implied by a legal or contractual framework are outside the scope of this document.
电子签名通常在法律或合同框架内应用。这就确立了对电子签名和任何特殊语义（如协议、意图）的要求。这些要求可以用非常一般的抽象术语或详细规则来定义。法律或合同框架暗示的与电子签名相关的特定语义不在本文件的范围内。
If the signature policy is recognized, within the legal/contractual context, as providing commitment, then the signer explicitly agrees with terms and conditions which are implicitly or explicitly part of the signed data.
如果在法律/合同范围内，签字政策被确认为提供承诺，则签字人明确同意作为签字数据隐式或显式部分的条款和条件。
When two independent parties want to evaluate an electronic signature, it is fundamental that they get the same result. It is therefore important that the conditions agreed by the signer at the time of signing are indicated to the verifier and any arbitrator. An aspect that enables this to be known by all parties is the signature policy. The technical implications of the signature policy on the electronic signature with all the validation data are called the "Signature Validation Policy". The signature validation policy specifies the rules used to validate the signature.
当两个独立的当事方想要评估一个电子签名时，最基本的是他们得到相同的结果。因此，重要的是，签字人在签字时商定的条件应向核查人和任何仲裁人表明。使各方都知道这一点的一个方面是签名策略。签名政策对具有所有验证数据的电子签名的技术影响称为“签名验证政策”。签名验证策略指定用于验证签名的规则。
This document does not mandate the form and encoding of the specification of the signature policy. However, for a given signature policy there must be one definitive form that has a unique binary encoded value.
本文件不强制规定签名策略规范的形式和编码。但是，对于给定的签名策略，必须有一个具有唯一二进制编码值的确定形式。
This document includes, as an option, a formal structure for signature validation policy based on the use of Abstract Syntax Notation 1 (ASN.1).
作为一种选择，本文档包括基于使用抽象语法符号1（ASN.1）的签名验证策略的正式结构。
Given the specification of the signature policy and its hash value an implementation of a verification process must obey the rules defined in the specification.
给定签名策略及其哈希值的规范，验证过程的实现必须遵守规范中定义的规则。
This document places no restriction on how it should be implemented. Provide the implementation conforms to the conformance requirements as define in section 5 implementation options include:
本文件对其实施方式没有任何限制。提供符合第5节中定义的一致性要求的实施方案，包括：
A validation process that supports a specific signature policy as identified by the signature policy OID. Such an implementation should conform to a human readable description provided all the processing rules of the signature policy are clearly defined. However, if additional policies need to be supported, then such an implementation would need to be customized for each additional policy. This type of implementation may be simpler to implement initially, but can be difficult to enhance to support numerous additional signature policies.
支持由签名策略OID标识的特定签名策略的验证过程。如果签名策略的所有处理规则都已明确定义，则此类实现应符合人类可读的描述。但是，如果需要支持其他策略，则需要为每个附加策略定制此类实现。这种类型的实现最初可能更容易实现，但很难增强以支持许多其他签名策略。
A validation process that is dynamically programmable and able to adapt its validation rules in accordance with a description of the signature policy provided in a computer-processable language. This present document defines such a policy using an ASN.1 structure (see 6.1). This type of implementation could support multiple signature policies without being modified every time, provided all the validation rules specified as part of the signature policy are known by the implementation. (i.e., only requires modification if there are additional rules specified).
一种验证过程，它是动态可编程的，并且能够根据以计算机可处理语言提供的签名策略的描述来调整其验证规则。本文件使用ASN.1结构定义了此类策略（见6.1）。这种类型的实现可以支持多个签名策略，而无需每次修改，前提是实现知道作为签名策略一部分指定的所有验证规则。（即，只有在规定了其他规则的情况下才需要修改）。
The precise content of a signature policy is not mandated by the current document. However, a signature policy must be sufficiently definitive to avoid any ambiguity as to its implementation requirements. It must be absolutely clear under which conditions an electronic signature should be accepted. For this reason, it should contain the following information:
当前文档不强制要求签名策略的确切内容。然而，签名政策必须具有足够的确定性，以避免其实施要求的任何模糊性。必须绝对明确在何种条件下接受电子签字。因此，应包含以下信息：
* General information about the signature policy which includes: - a unique identifier of the policy; - the name of the issuer of the policy; - the date the policy was issued; - the field of application of the policy.
* 有关签名策略的一般信息，包括：-策略的唯一标识符；-保单发行人的名称；-保单签发日期；-政策的应用领域。
* The signature verification policy which includes: - the signing period, - a list of recognized commitment types; - rules for Use of Certification Authorities; - rules for Use of Revocation Status Information; - rules for Use of Roles; - rules for use of Time-Stamping and Timing; - signature verification data to be provided by the signer/collected by verifier; - any constraints on signature algorithms and key lengths. * Other signature policy rules required to meet the objectives of the signature.
* 签名验证策略，包括：-签名期限，-公认承诺类型列表；-认证机构的使用规则；-撤销状态信息的使用规则；-角色使用规则；-时间戳和计时的使用规则；-签名人提供/验证人收集的签名验证数据；-签名算法和密钥长度的任何约束。*满足签名目标所需的其他签名政策规则。
Variations of the validation policy rules may apply to different commitment types.
验证策略规则的变化可能适用于不同的承诺类型。
When data is signed the signer indicates the signature policy applicable to that electronic signature by including an object identifier for the signature policy with the signature. The signer and verifier must apply the rules specified by the identified policy. In addition to the identifier of the signature policy the signer must include the hash of the signature policy, so it can be verified that the policy selected by the signer is the identical to the one being used the verifier.
当对数据进行签名时，签名人通过在签名中包含签名策略的对象标识符来指示适用于该电子签名的签名策略。签名者和验证者必须应用已识别策略指定的规则。除了签名策略的标识符外，签名者还必须包括签名策略的哈希，以便可以验证签名者选择的策略是否与验证者使用的策略相同。
A signature policy may be qualified by additional information. This can includes:
签名策略可以由附加信息限定。这可以包括：
* A URL where a copy of the Signature Policy may be obtained; * A user notice that should be displayed when the signature is verified;
* 可获取签名策略副本的URL；*验证签名时应显示的用户通知；
If no signature policy is identified then the signature may be assumed to have been generated/verified without any policy constraints, and hence may be given no specific legal or contractual significance through the context of a signature policy.
如果未确定签名策略，则可以假设签名是在没有任何策略约束的情况下生成/验证的，因此在签名策略的上下文中可能没有特定的法律或合同意义。
A "Signature Policy" will be identifiable by an OID (Object Identifier) and verifiable using a hash of the signature policy.
“签名策略”将由OID（对象标识符）标识，并可使用签名策略的散列进行验证。
General information should be recorded about the signature policy along with the definition of the rules which form the signature policy as described in subsequent subsections. This should include:
应记录有关签名政策的一般信息以及构成签名政策的规则的定义，如后续小节所述。这应包括：
* Policy Object Identifier: The "Signature Policy" will be identifiable by an OID (Object Identifier) whose last component (i.e., right most) is an integer that is specific to a particular version issued on the given date. * Date of issue: When the "Signature Policy" was issued. * Signature Policy Issuer name: An identifier for the body responsible for issuing the Signature Policy. This may be used by the signer or verifying in deciding if a policy is to be trusted, in which case the signer/verifier must authenticate the origin of the signature policy as coming from the identified issuer. * Signing period: The start time and date, optionally with an end time and date, for the period over which the signature policy may be used to generate electronic signatures.
* 策略对象标识符：“签名策略”将由OID（对象标识符）标识，OID的最后一个组件（即最右边）是特定于给定日期发布的特定版本的整数。*签发日期：签发“签名保单”时。*签名策略颁发者名称：负责颁发签名策略的机构的标识符。签名人或验证人可使用此选项来决定是否信任策略，在这种情况下，签名人/验证人必须验证签名策略的来源是否来自已识别的颁发者。*签名期间：签名策略可用于生成电子签名的期间的开始时间和日期（可选带有结束时间和日期）。
* Field of application: This defines in general terms the general legal/contract/application contexts in which the signature policy is to be used and the specific purposes for which the electronic signature is to be applied.
* 适用领域：这一般性地定义了使用签名政策的一般法律/合同/应用环境以及应用电子签名的具体目的。
The signature validation policy may recognize one or more types of commitment as being supported by electronic signatures produced under the security policy. If an electronic signature does not contain a recognized commitment type then the semantics of the electronic signature is dependent on the data being signed and the context in which it is being used.
签名验证策略可将一种或多种类型的承诺确认为由根据安全策略生成的电子签名支持。如果电子签名不包含公认的承诺类型，则电子签名的语义取决于所签名的数据及其使用的上下文。
Only recognized commitment types are allowed in an electronic signature.
电子签名中只允许使用公认的承诺类型。
The definition of a commitment type includes:
承诺类型的定义包括：
* the object identifier for the commitment; * the contractual/legal/application context in which the signature may be used (e.g., submission of messages); * a description of the support provided within the terms of the context (e.g., proof that the identified source submitted the message if the signature is created when message submission is initiated).
* 承诺的对象标识符；*可使用签字的合同/法律/应用环境（如提交电文）；*在上下文条款中提供的支持说明（例如，如果在消息提交启动时创建了签名，则证明已识别的源提交了消息）。
The definition of a commitment type can be registered:
可以注册承诺类型的定义：
* as part of the validation policy; * as part of the application/contract/legal environment; * as part of generic register of definitions.
* 作为验证政策的一部分；*作为申请/合同/法律环境的一部分；*作为通用定义登记册的一部分。
The legal/contractual context will determine the rules applied to the signature, as defined by the signature policy and its recognized commitment types, make it fit for purpose intended.
法律/合同背景将决定适用于签字的规则，如签字政策及其公认的承诺类型所定义，使其符合预期目的。
The certificate validation process of the verifier, and hence the certificates that may be used by the signer for a valid electronic signature, may be constrained by the combination of the trust point and certificate path constraints in the signature validation policy.
验证者的证书验证过程，以及因此签名者可用于有效电子签名的证书，可由签名验证策略中的信任点和证书路径约束的组合来约束。
The signature validation policy defines the certification authority trust points that are to be used for signature verification. Several trust points may be specified under one signature policy. Specific trust points may be specified for a particular type of commitment defined under the signature policy. For a signature to be valid a certification path must exists between the Certification Authority that has granted the certificate selected by the signer (i.e., the used user-certificate) and one of the trust point of the "Signature Validation Policy".
签名验证策略定义了用于签名验证的证书颁发机构信任点。可以在一个签名策略下指定多个信任点。可以为签名策略下定义的特定类型的承诺指定特定的信任点。要使签名有效，必须在授予签名者选择的证书（即已使用的用户证书）的证书颁发机构和“签名验证策略”的一个信任点之间存在证书路径。
There may be constraints on the use of certificates issued by one or more CA(s) in the certificate chain and trust points. The two prime constraints are certificate policy constraints and naming constraints:
证书链和信任点中的一个或多个CA颁发的证书的使用可能会受到限制。两个主要约束是证书策略约束和命名约束：
* Certificate policy constraints limit the certification chain between the user certificate and the certificate of the trusted point to a given set of certificate policies, or equivalents identified through certificate policy mapping. * The naming constraints limit the forms of names that the CA is allowed to certify.
* 证书策略约束将用户证书和受信任点的证书之间的证书链限制为给定的一组证书策略，或通过证书策略映射标识的等效项。*命名约束限制了CA可以认证的名称的形式。
Name constraints are particularly important when a "Signature policy" identifies more than one trust point. In this case, a certificate of a particular trusted point may only be used to verify signatures from users with names permitted under the name constraint.
当“签名策略”标识多个信任点时，名称约束尤为重要。在这种情况下，特定受信任点的证书只能用于验证具有名称约束下允许的名称的用户的签名。
Certificate Authorities may be organized in a tree structure, this tree structure may represent the trust relationship between various CA(s) and the users CA. Alternatively, a mesh relationship may exist where a combination of tree and peer cross-certificates may be used. The requirement of the certificate path in this document is that it provides the trust relationship between all the CAs and the signers user certificate. The starting point from a verification point of view, is the "trust point". A trust point is usually a CA that publishes self-certified certificates, is the starting point from which the verifier verifies the certificate chain. Naming constraints may apply from the trust point, in which case they apply throughout the set of certificates that make up the certificate path down to the signer's user certificate.
证书颁发机构可以组织在树结构中，该树结构可以表示各种CA和用户CA之间的信任关系。或者，可以存在网状关系，其中可以使用树和对等交叉证书的组合。本文档中证书路径的要求是，它提供所有CA和签名者用户证书之间的信任关系。从验证的角度来看，起点是“信任点”。信任点通常是发布自认证证书的CA，是验证器验证证书链的起点。命名约束可以从信任点开始应用，在这种情况下，它们应用于构成证书路径的整个证书集，直至签名者的用户证书。
Policy constraints can be easier to process but to be effective require the presence of a certificate policy identifier in the certificates used in a certification path.
策略约束可以更容易处理，但要有效，需要在证书路径中使用的证书中存在证书策略标识符。
Certificate path processing, thus generally starts with one of the trust point from the signature policy and ends with the user certificate. The certificate path processing procedures defined in RFC 2459 section 6 identifies the following initial parameters that are selected by the verifier in certificate path processing:
因此，证书路径处理通常从签名策略中的一个信任点开始，以用户证书结束。RFC 2459第6节中定义的证书路径处理过程确定了验证器在证书路径处理中选择的以下初始参数：
* acceptable certificate policies; * naming constraints in terms of constrained and excluded naming subtree; * requirements for explicit certificate policy indication and whether certificate policy mapping are allowed; * restrictions on the certificate path length.
* 可接受的证书策略；*根据受约束和排除的命名子树命名约束；*明确的证书策略指示要求以及是否允许证书策略映射；*对证书路径长度的限制。
The signature validation policy identifies constraints on these parameters.
签名验证策略标识这些参数的约束。
The signature policy should defines rules specifying requirements for the use of certificate revocation lists (CRLs) and/or on-line certificate status check service to check the validity of a certificate. These rules specify the mandated minimum checks that must be carried out.
签名策略应定义规则，规定使用证书吊销列表（CRL）和/或在线证书状态检查服务检查证书有效性的要求。这些规则规定了必须执行的强制性最低限度检查。
It is expected that in many cases either check may be selected with CRLs checks being carried out for certificate status that are unavailable from OCSP servers. The verifier may take into account information in the certificate in deciding how best to check the revocation status (e.g., a certificate extension field about authority information access or a CRL distribution point) provided that it does not conflict with the signature policy revocation rules.
预计在许多情况下，在对OCSP服务器不可用的证书状态执行CRLs检查时，可以选择其中一种检查。验证器在决定如何最好地检查撤销状态（例如，关于权限信息访问的证书扩展字段或CRL分发点）时可以考虑证书中的信息，前提是它不与签名策略撤销规则冲突。
Roles can be supported as claimed roles or as certified roles using Attribute Certificates.
可以使用属性证书将角色支持为声明角色或认证角色。
When signature under a role is mandated by the signature policy, then either Attribute Certificates may be used or the signer may provide a claimed role attribute. The acceptable attribute types or values may be dependent on the type of commitment. For example, a user may have several roles that allow the user to sign data that imply commitments based on one or more of his roles.
当签名策略强制角色下的签名时，可以使用属性证书，或者签名者可以提供声明的角色属性。可接受的属性类型或值可能取决于承诺的类型。例如，用户可能有多个角色，允许用户签署数据，这些数据暗示基于其一个或多个角色的承诺。
When a signature under a certified role is mandated by the signature policy, Attribute Authorities are used and need to be validated as part of the overall validation of the electronic signature. The trust points for Attribute Authorities do not need to be the same as the trust points to evaluate a certificate from the CA of the signer. Thus the trust point for verifying roles need not be the same as trust point used to validate the certificate path of the user's key.
当签名策略强制使用认证角色下的签名时，将使用属性权限，并且需要作为电子签名整体验证的一部分进行验证。属性权限的信任点不需要与信任点相同，即可评估来自签名者CA的证书。因此，用于验证角色的信任点不必与用于验证用户密钥的证书路径的信任点相同。
Naming and certification policy constraints may apply to the AA in similar circumstance to when they apply to CA. Constraints on the AA and CA need not be exactly the same.
命名和认证策略约束可能适用于AA，情况与适用于CA类似。AA和CA上的约束不必完全相同。
AA(s) may be used when a signer is creating a signature on behalf of an organization, they can be particularly useful when the signature represents an organizational role. AA(s) may or may not be the same authority as CA(s).
当签名人代表组织创建签名时，可以使用AA，当签名代表组织角色时，AA特别有用。AA可以是也可以不是CA的同一机构。
Thus, the Signature Policy identifies trust points that can be used for Attribute Authorities, either by reference to the same trust points as used for Certification Authorities, or by an independent list.
因此，签名策略通过引用用于证书颁发机构的相同信任点或通过独立列表来标识可用于属性颁发机构的信任点。
Attribute Authorities may be organized in a tree structure in similar way to CA where the AAs are the leafs of such a tree. Naming and other constraints may be required on attribute certificate paths in a similar manner to other electronic signature certificate paths.
属性权限可以以类似于CA的方式组织在树结构中，其中AAs是此类树的叶子。属性证书路径上可能需要命名和其他约束，其方式与其他电子签名证书路径类似。
Thus, the Signature Policy identify constraints on the following parameters used as input to the certificate path processing:
因此，签名策略识别对用作证书路径处理输入的以下参数的约束：
* acceptable certificate policies, including requirements for explicit certificate policy indication and whether certificate policy mapping is allowed; * naming constraints in terms of constrained and excluded naming subtrees; * restrictions on the certificate path length.
* 可接受的证书策略，包括明确的证书策略指示要求以及是否允许证书策略映射；*根据受约束和排除的命名子树命名约束；*对证书路径长度的限制。
The following rules should be used when specifying, constraints on the certificate paths for time-stamping authorities, constraints on the time-stamping authority names and general timing constraints.
指定时间戳机构的证书路径约束、时间戳机构名称约束和一般时间约束时，应使用以下规则。
Signature keys from time-stamping authorities will need to be supported by a certification path. The certification path used for time-stamping authorities requires a trustpoint and possibly path constraints in the same way that the certificate path for the signer's key.
来自时间戳机构的签名密钥需要有一个认证路径的支持。用于时间戳颁发机构的证书路径需要信任点，并且可能需要路径约束，其方式与签名者密钥的证书路径相同。
Restrictions may need to be placed by the validation policy on the named entities that may act a time-stamping authorities.
验证策略可能需要对可能作为时间戳管理机构的命名实体施加限制。
Before an electronic signature may really be valid, the verifier has to be sure that the holder of the private key was really the only one in possession of key at the time of signing. However, there is an inevitable delay between a compromise or loss of key being noted, and a report of revocation being distributed. To allow greater confidence in the validity of a signature, a "cautionary period" may be identified before a signature may be said to be valid with high confidence. A verifier may revalidate a signature after this cautionary signature, or wait for this period before validating a signature.
在电子签名可能真正有效之前，验证者必须确保私钥持有人在签名时确实是唯一拥有密钥的人。但是，在注意到密钥泄露或丢失与分发撤销报告之间不可避免地存在延迟。为了使人们对签名的有效性有更大的信心，可以先确定“警戒期”，然后才可以说签名是高度可信的有效签名。验证者可以在此警告性签名之后重新验证签名，或者在验证签名之前等待这段时间。
The validation policy may specify such a cautionary period.
验证政策可规定此类警戒期。
There will be some delay between the time that a signature is created and the time the signer's digital signature is time-stamped. However, the longer this elapsed period the greater the risk of the signature being invalidated due to compromise or deliberate revocation of its private signing key by the signer. Thus the signature policy should specify a maximum acceptable delay between the signing time as claimed by the signer and the time included within the time-stamp.
签名创建时间与签名人的数字签名加盖时间戳之间会有一些延迟。但是，经过的时间越长，由于签名者泄露或故意撤销其私有签名密钥而导致签名无效的风险就越大。因此，签名策略应指定签名者声称的签名时间与时间戳中包含的时间之间的最大可接受延迟。
By specifying the requirements on the signer and verifier the responsibilities of the two parties can be clearly defined to establish all the necessary information.
通过规定对签字人和验证者的要求，可以明确界定双方的责任，以建立所有必要的信息。
These verification data rules should include:
这些验证数据规则应包括：
* requirements on the signer to provide given signed attributes; * requirements on the verifier to obtain additional certificates, CRLs, results of on line certificate status checks and to use time-stamps (if no already provided by the signer).
* 对签名者提供给定签名属性的要求；*要求验证者获得附加证书、CRL、在线证书状态检查结果以及使用时间戳（如果签名者尚未提供）。
The signature validation policy may identify a set of signing algorithms (hashing, public key, combinations) and minimum key lengths that may be used:
签名验证策略可识别一组签名算法（散列、公钥、组合）和可使用的最小密钥长度：
* by the signer in creating the signature; * in end entity public key Certificates; * CA Certificates; * attribute Certificates; * by the time-stamping authority.
* 由签名人在创建签名时执行；*最终实体公钥证书；*CA证书；*属性证书；*时间戳管理局。
The signature policy may specify additional policy rules, for example rules that relate to the environment used by the signer. These additional rules may be defined in computer processable and/or human readable form.
签名策略可以指定附加的策略规则，例如与签名者使用的环境相关的规则。这些附加规则可以以计算机可处理和/或人类可读的形式定义。
When signer or verifier obtains a copy of the Signature Policy from an issuer, the source should be authenticated (for example by using electronic signatures). When the signer references a signature policy the Object Identifier (OID) of the policy, the hash value and the hash algorithm OID of that policy must be included in the Electronic Signature.
当签名人或验证者从发行人处获得签名策略副本时，应对源进行身份验证（例如使用电子签名）。当签名者引用签名策略时，该策略的对象标识符（OID）、该策略的哈希值和哈希算法OID必须包含在电子签名中。
It is a mandatory requirement of this present document that the signature policy value computes to one, and only one hash value using the specified hash algorithm. This means that there must be a single binary value of the encoded form of the signature policy for the unique hash value to be calculated. For example, there may exist a particular file type, length and format on which the hash value is calculated which is fixed and definitive for a particular signature policy.
本文件的强制性要求是，签名策略值计算为1，并且使用指定的哈希算法仅计算一个哈希值。这意味着签名策略的编码形式必须有一个二进制值，才能计算唯一的哈希值。例如，可能存在一个特定的文件类型、长度和格式，在该文件类型、长度和格式上计算哈希值，该哈希值对于特定签名策略是固定和确定的。
The hash value may be obtained by:
散列值可通过以下方式获得：
the signer performing his own computation of the hash over the signature policy using his preferred hash algorithm permitted by the signature policy, and the definitive binary encoded form.
签名者使用签名策略允许的首选哈希算法和最终二进制编码形式，在签名策略上执行自己的哈希计算。
the signer, having verified the source of the policy, may use both the hash algorithm and the hash value included in the computer processable form of the policy (see section 6.1).
签名者在验证了策略的来源后，可以使用哈希算法和包含在策略的计算机可处理形式中的哈希值（参见第6.1节）。
Full Copyright Statement
完整版权声明
Copyright (C) The Internet Society (2001). All Rights Reserved.
版权所有（C）互联网协会（2001年）。版权所有。
This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.
本文件及其译本可复制并提供给他人，对其进行评论或解释或协助其实施的衍生作品可全部或部分编制、复制、出版和分发，不受任何限制，前提是上述版权声明和本段包含在所有此类副本和衍生作品中。但是，不得以任何方式修改本文件本身，例如删除版权通知或对互联网协会或其他互联网组织的引用，除非出于制定互联网标准的需要，在这种情况下，必须遵循互联网标准过程中定义的版权程序，或根据需要将其翻译成英语以外的其他语言。
The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.
上述授予的有限许可是永久性的，互联网协会或其继承人或受让人不会撤销。
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
本文件和其中包含的信息是按“原样”提供的，互联网协会和互联网工程任务组否认所有明示或暗示的保证，包括但不限于任何保证，即使用本文中的信息不会侵犯任何权利，或对适销性或特定用途适用性的任何默示保证。
Acknowledgement
确认
Funding for the RFC Editor function is currently provided by the Internet Society.
RFC编辑功能的资金目前由互联网协会提供。